Sign In Start Free Trial

CORS Essentials

By : Gunasundaram

3 (1)

CORS Essentials

3 (1)

By: Gunasundaram

Overview of this book

This book explains how to use CORS, including specific implementations for platforms such as Drupal, WordPress, IIS Server, ASP.NET, JBoss, Windows Azure, and Salesforce, as well as how to use CORS in the Cloud on Amazon AWS, YouTube, Mulesoft, and others. It examines limitations, security risks, and alternatives to CORS. It explores the W3C Specification and major developer documentation sources about CORS. It attempts to predict what kinds of extension to the CORS specification, or completely new techniques, will come in the future to address the limitations of CORS Web developers will learn how to share code and assets across domains with CORS. They will learn a variety of techniques that are rather similar in their method and syntax. The book is organized by similar types of framework and application, so it can be used as a reference. Developers will learn about special cases, such as when a proxy is necessary. And they will learn about some alternative techniques that achieve similar goals, and when they may be preferable to using CORS

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Free Chapter

1. Why You Need CORS

1. Why You Need CORS

The same-origin policy

Considering the origin of entities

Commonly allowed cross-origin resource sharing

Permissions required by JavaScript

How CORS works – the header and the request

CORS with Preflight

Troubleshooting and debugging CORS

CORS with jQuery

Enabling CORS globally with server configuration

Alternatives to CORS

Summary

2. Creating Proxies for CORS

2. Creating Proxies for CORS

Proxies and the World Wide Web

What is a proxy server?

Reasons to use a proxy

Creating a proxy server with Google App Engine

Summary

3. Usability and Security

3. Usability and Security

CORS usability

Enhancing security in CORS

Summary

4. CORS in Popular Content Management Frameworks

4. CORS in Popular Content Management Frameworks

Incoming CORS requests

SAAS or self-hosted?

CORS in WordPress

CORS in Drupal

CORS in Joomla!

CORS in Adobe Experience Manager

Summary

5. CORS in Windows

5. CORS in Windows

Incoming CORS requests

How to set the Access-Control-Allow-Origin header globally in Windows IIS Server

CORS in the ASP.NET Web API

CORS in Windows Communication Foundation

CORS in Windows browsers – Internet Explorer and Edge

Summary

6. CORS in the Cloud

6. CORS in the Cloud

CORS requests in cloud APIs

CORS in Amazon Simple Storage Service (S3)

Using CORS in Google Cloud Storage

Authenticated access to Google APIs with CORS

CORS in IBM Cloudant

CORS in Windows Azure Storage

CORS in Box API

CORS in the Dropbox API

Summary

References

7. CORS in Node.js

7. CORS in Node.js

JavaScript frameworks are very popular

Introduction to Node.js

JavaScript frameworks that work with Node.js

CORS in Express.js

CORS npm for Express.js using Connect.js middleware

CORS in AngularJS

CORS in Backbone.js

Node.js and JavaScript frameworks are evolving rapidly

Summary

References

8. CORS Best Practices

8. CORS Best Practices

Enabling API to public CORS requests

Limiting API to allow CORS requests to a whitelisted set of origins

Protecting against cross-site request forgery (CSRF)

Summary

Index

Index

Customer Reviews

3 (1)

5 star

0

4 star

0

3 star

100%

2 star

0

1 star

0

CORS in Windows Communication Foundation

Windows Communication Foundation (WCF) is another service-oriented Windows .NET framework component that is suitable for building applications that use CORS.

The WCF sends data as asynchronous messages from one service endpoint to another. A service endpoint can be hosted by IIS, or it can be hosted in an application. It can be a client of a service that requests data from a service endpoint.

Out of the box, WCF cannot make cross-origin requests because it does not send the required CORS headers: Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Methods. WCF can also send the optional CORS headers: Access-Control-Allow-Headers and Access-Control-Max-Age.

Create a global.asax file to add the necessary HTTP headers to Application_BeginRequest. The following example of code for the global.asax file allows a request from http://localdomain.com, using allowed HTTP methods POST, PUT, DELETE. It allows http://localdomain.com...

Search

Your notes and bookmarks