CORS & SOP

Introduction

Cross-Origin Resource Sharing, also known as CORS, is a mechanism that allows web applications to request resources from different domains securely. This is crucial in web security as it prevents malicious scripts on one page from obtaining access to sensitive data on another web page through the browser.

Same-origin policy, also known as SOP, is a security measure restricting web pages from interacting with resources from different origins. An origin is defined by the scheme (protocol), hostname (domain), and URL port.

Objectives

1. Understand the fundamental principles of CORS and SOP.
2. Identify and understand the security implications of CORS and SOP configurations.
3. Exploit CORS and SOP-related vulnerabilities in a controlled environment.
4. Understand and apply measures to mitigate and prevent these vulnerabilities.

Pre-requisites

1. Basic understanding of web application architecture and server-side scripting.
2. Familiarity with web server configurations and HTTP headers.
3. Knowledge of JavaScript's XMLHttpRequest (XHR) or Fetch API.