cors

AI security interview questions tagged cors, across every topic.

2 questions · 0 unlocked for you

Open full answer →

Open full answer →

Concepts behind "cors"

Explanations of the mechanisms these questions rely on.

Application Security🔒 Premium

How Browsers Separate Origins: SOP, CORS and CSRFThe same-origin policy lets a page send requests almost anywhere but stops its script reading responses from other origins. CORS is the server's way to relax that read restriction for chosen origins; it never stops a request being sent. CSRF is the attack that exploits sending: a cross-site page makes the victim's browser submit a request with the victim's cookies. The defences are separate: exact CORS allowlists for reads, and for writes a CSRF token, Fetch Metadata checks, strict content types and SameSite cookies as defence in depth.

Explore the full curriculum →