CORS 究竟如何提高安全性
我确切地知道 CORS 是如何工作的，我知道它是在浏览器上实现的，并且我知道它禁止向其他来源发送 XMLHTTPRequest，除非远程来源允许它使用响应标头 Access-Control-Allow-Origin。
当然，我听说这是因为“安全原因”。
我不明白的是它如何提高安全性。
因此，想象一下我们在浏览器中，我们的页面中加载了一个恶意 js 文件，它想要将我们的本地存储数据或 cookie 发送到另一个源（黑客源）。所以黑客只需将“Access-Control-Allow-Origin”设置为 * 就可以了！那么 CORS 到底做了什么？
我在某个地方读到 CORS 的存在是因为“知识产权”，这在某种程度上是有道理的，所以一些远程服务器不想回答其他客户端的请求。没关系.. 。但出于安全原因！？我不明白那部分。
如果有人能帮助我，我将不胜感激。
I know exactly how CORS is working, i know it's implemented on browsers, and i know it forbids XMLHTTPRequests to other origins unless the remote origin allows it using the response header Access-Control-Allow-Origin.
And of-course I heard it's because the "security reasons" that it's there.
The thing i don't get is how it's improving security.
So imagine we're in a browser and we have a malicious js file loaded in our page and it wants to send our local storage data or cookies to another origin (hacker origin). so the hacker simply set the "Access-Control-Allow-Origin" to * and he's good to go! so what CORS did exactly here?
Somewhere i read that CORS is there because of "intellectual property" and that makes sense somehow, so some remote servers don't want to answer to requests from other clients. that's ok.. . but for security reasons!? I don't get that part.
I would appreciate if anyone could help me with this.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论