#Preflight definition how to#

As with the ` Origin` header, if it's not something your API supports, then you know something is going on. The other easy thing to validate is that the ` Access-Control-Request-Method` is actually a supported HTTP method used in your API. If the ` Origin` header isn't a match to your access list, then it's a good canary that an attack might be incoming. This isn't going to stop 100% of attacks, but it should at least slow down and discourage attackers and significantly reduce the risk of an automated malicious advert attack being successful. The ` Origin` should be checked against an access list by the server to confirm that scripts from that origin are acceptable.

` Access-Control-Request-Headers` – The custom headers that the browser expects to send along with the actual request to follow. ` Access-Control-Request-Method` – The method that the script would like to use in the actual request to follow. ` Origin` – The (sub)domain that the script making the request was served to the browser from. So What Are the Request Headers, and What Do They Do?Īccess control request headers are fairly straight forward and for the most part pretty self-explanatory. This allows the browser to keep that response cached as a form of pre-validation for any future requests that the script might wish to make. These response headers define the range of acceptable origins, request methods, custom headers, whether or not it's acceptable to send any credentials (such as cookies, authentication headers, etc.), and how long the browser should keep the response for. Once verified the external web server should then respond with its own set of HTTP headers. The external web server should then validate these preflight request headers to ensure that scripts from that origin are allowed to make the actual request to the resource using the nominated request method and custom request headers specified in the preflight request headers. This preflight request uses the HTTP method OPTIONS and has several HTTP headers that we'll go into detail on later. This workflow begins with the browser automatically making a preflight request to the external web server. How Does CORS Work?Īs mentioned above the CORS workflow starts when a script loaded from one origin attempts to make a request to another origin (thus the name Cross-Origin Resource Sharing).

#Preflight definition how to#

This article attempts to dispel some of the common misconceptions about Cross-Origin Resource Sharing and provide useful advice on how to get things working correctly. There's a lot of terrible advice out there (especially on popular forums) on how to set this up where the answers generally include some variant of brutally setting wildcard ' *' response headers regardless of the request headers provided in the pre-flight request. This is all controlled through preflight requests that exchange a set of HTTP request headers and corresponding response headers collectively referred to as 'CORS Headers', each of these headers modifies a different element of the Same-Origin policy to loosen the limitations it imposes. This kind of request would be called a Cross-Origin request, as a resource from one subdomain is requesting a resource from another subdomain. So then, what is CORS? Simply put, CORS is the mechanism that provides the ability to alter the behavior of this policy, enabling you to do things like hosting static content at and the backend API at. In short, it dictates that when your browser loads a script (like a button handler, or some async widget) from a particular (sub)domain that the script can only make requests to the (sub)domain that it originated from. This precursor to CORS was called the 'Same-Origin' policy.

As you've possibly already come across by now, CORS is an acronym for Cross-Origin Resource Sharing, but what does that actually mean? What is CORS? Well, if we go by the Wikipedia definition, ' is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served,' then you'd be forgiven if you were more confused than before you'd read that sentence.īefore we get into defining CORS, it's best to know what came before, as it still defines the default behavior and is probably why you're reading this now.