Sign In Start Free Trial
Account

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • CORS Essentials
  • Toc
  • feedback
CORS Essentials

CORS Essentials

By : Gunasundaram
3 (1)
close
CORS Essentials

CORS Essentials

3 (1)
By: Gunasundaram

Overview of this book

This book explains how to use CORS, including specific implementations for platforms such as Drupal, WordPress, IIS Server, ASP.NET, JBoss, Windows Azure, and Salesforce, as well as how to use CORS in the Cloud on Amazon AWS, YouTube, Mulesoft, and others. It examines limitations, security risks, and alternatives to CORS. It explores the W3C Specification and major developer documentation sources about CORS. It attempts to predict what kinds of extension to the CORS specification, or completely new techniques, will come in the future to address the limitations of CORS Web developers will learn how to share code and assets across domains with CORS. They will learn a variety of techniques that are rather similar in their method and syntax. The book is organized by similar types of framework and application, so it can be used as a reference. Developers will learn about special cases, such as when a proxy is necessary. And they will learn about some alternative techniques that achieve similar goals, and when they may be preferable to using CORS
Table of Contents (10 chapters)
close
9
Index

Protecting against cross-site request forgery (CSRF)

A CSRF attack is a malicious action that involves sending a request to any website that is already authenticated by the user. This way, it enables the attacker to perform any functionality in the target website via the browser of the user.

The best practice to prevent cross-site request forgery (CSRF) is to append unpredictable challenge tokens to requests and associate them with the user sessions. The unpredictable challenge tokens should be unique per user session or per request. These unpredictable challenge tokens should be verified to make sure the request is valid and is coming from a valid source. If the unpredictable challenge token is not valid, then the request is coming from a source other than the user, and that needs to be blocked.

Minimizing preflight requests

Preflight requests are sent by browsers in order to make sure that the actual requests are trusted by the servers. It means that the server will respond with the details...

bookmark search playlist font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected

Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete