Grokking Spring Boot
Vote

0% completed

​

CORS and CSRF

Two requests for the public event list reached the booking service. They were identical except for one header.

GET /events   Origin: https://cheap-tickets.example   ->  403  Invalid CORS request
GET /events                                           ->  200  [{"id":7,"title":"Evening Concert"}, ...]

The first claimed to come from a page on another site and was refused. The second named no site and received the list, although anyone can send it. So the refusal cannot be protecting the event list

.....

.....

.....

Like the course? Get enrolled and start learning!

Reading Progress

0%

Vote for new content