Introduction à CORS
Si on modifie document.domain, il faut le faire sur toutes les pages (sub.example.com et example.com)
fetch(`https://example.com/resource`, {
method: 'GET',
headers: { 'Accept': 'application/json' },
}).then(res => {
if (res.ok) {
return res.json()
} else {
return Promise.reject(res.statusText)
}
}).then(console.log)
.catch(console.error)
Tout ce qui n’est pas une requête simple
fetch(`https://example.com/resource`, {
method: 'POST',
headers: { 'Accept': 'application/json',
'Content-Type': 'application/json' },
body: { id: '9408e0e9-9dcc-46a1-a75b-be553e39da15' }
}).then(res => {
if (res.ok) {
return res.json()
} else {
return Promise.reject(res.statusText)
}
}).then(console.log)
.catch(console.error)
OPTIONS /resource HTTP/1.1
Host: example.com
User-Agent:
Accept:
Connection:
Origin: https://my.domain.com
Access-Control-Request-Method: POST
Access-Control-Request-Headers: Content-Type
HTTP/1.1 200 OK
Date:
Server:
Access-Control-Allow-Origin: https://my.domain.com
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Headers: Content-Type
Access-Control-Max-Age: 86400
Content-Encoding:
Content-Length:
Keep-Alive:
Connection:
Content-Type:
POST /resource HTTP/1.1
Host: example.com
User-Agent:
Accept:
Content-Type: application/json
Referer:
Content-Length:
Origin: https://my.domain.com
{ "id": "9408e0e9-9dcc-46a1-a75b-be553e39da15" }
HTTP/1.1 200 OK
Date:
Server:
Access-Control-Allow-Origin: https://my.domain.com
Content-Encoding: ..
Content-Length:
Keep-Alive:
Connection:
Content-Type:
Exemple de mauvaise config:
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
fetch(`https://example.com/resource`, {
method: 'GET',
credentials: 'include',
headers: { 'Accept': 'application/json' },
}).then(res => {
if (res.ok) {
return res.json()
} else {
return Promise.reject(res.statusText)
}
}).then(console.log)
.catch(console.error)
GET /resource HTTP/1.1
Host: example.com
User-Agent: ..
Accept: ..
Origin: http://my.domain.com
Cookie: session_id=2
HTTP/1.1 200 OK
Date:
Server:
Access-Control-Allow-Origin: http://my.domain.com
Access-Control-Allow-Credentials: true
Set-Cookie: session_id=2; expires=...
Content-Encoding:
Content-Length:
Content-Type:
Access-Control-Content-Origin
* si api publique
Access-Control-Allow-Credentials