HTML 5 Security Concerns
{"Image DocumentName": "HTML 5 Security Concerns", "Image ImageDescription": "Cross-Origin Resource Sharing (CORS) Server-side solution to circumvent the same-origin policy. <% Response.AddHeader( Access-Control-Allow-Origin , <origin> |   ) %> Allows XHR Level 2 object to initiate a cross domain request directly. Simple Request \u2013 GET/HEAD/POST with Content-Type \u2018text/plain\u2019 Preflight Request. CORS support on browsers (http://caniuse/com/cors) Threat: Cross-Site-Request-Forgery. 2. Log In. Access-Control-Allow-Origin:   1. Open page. Web Server: myapp.com. 3. Session cookie. REST API.   .ajax({ url:  , type: \u2018post\u2019, crossDomain: true, contentType: text/plain; charset=UTF-8 , data: \u2018{ user : evilUser }\u2019, beforeSend: function(xhr) { xhr.withCredentials = true; } }); (jQuery ) 5. XHR. Content-Type : text/plain. withCredentials : true. Invoke any REST API call. Victim using CORS capable browser. 4. Open page. Attacker.", "Image XResolution": "37", "Image YResolution": "37", "Image ResolutionUnit": "Pixels/Centimeter", "Image Software": "SlidePlayer", "Image YCbCrPositioning": "Centered"}