Home/ Questions/Q 6835419
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T23:13:48+00:00

I want to allow client applications to make cross domain JSON requests to a

  • 0

I want to allow client applications to make cross domain JSON requests to a central data server. The clients and server will be on different domains.

To get around the “Origin null is not allowed by Access-Control-Allow-Origin.” error, I have the server set a:

Access-Control-Allow-Origin: *

header.

I see here (http://www.w3.org/wiki/CORS_Enabled) that cross domain should only be used for “public data which doesn’t require cookie or session based authentication”.

Is is not safe to use session/cookie based authentication when using the Access-Control-Allow-Origin: * header? If not why?

Thank you.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Having a CORS ruleset of Access-Control-Allow-Origin: * isn’t a full Same-origin policy bypass, and is probably safe.

    Having this header set on every page allows for unauthenticated resource-requests. Authentication cookies are not implicitly included with these requests, so a cross-site XHR couldn’t be used to lets say; read your email, or read CSRF tokens on a remote domain – because these requests would require a cookie or a bearer token.

    • 0