Origin Access Control - Revision history

Tom: /* Problems */

2024-01-28T06:42:16Z

‎Problems

Tom: /* Problems */

2024-01-28T06:39:40Z

‎Problems

Tom: /* COEP */

2024-01-28T05:50:54Z

‎COEP

Tom: /* COEP */

2024-01-27T22:35:47Z

‎COEP

Tom: /* References */

2024-01-27T22:33:50Z

‎References

Tom: /* CORS */

2024-01-27T22:31:00Z

‎CORS

Tom: /* References */

2024-01-27T22:30:37Z

‎References

Tom: /* References */

2024-01-27T22:21:28Z

‎References

Tom: /* Other Materiel */

2024-01-27T22:21:15Z

‎Other Materiel

Tom: /* References */

2024-01-27T22:20:32Z

‎References

@@ Line 60: / Line 60: @@
 The browser changes from 2020 to cookie sameSite properties also made it so that a server that wishes to support POST at its authorization endpoint needs to relax its cookie settings to sameSite: "none" explicitly in order for the received POST request to carry the server's previous cookies. This is unfortunate because the default "lax" behavior is generally more secure and aids in limiting unintended exposure to cross site request forgery.
-* [https://developers.google.com/search/blog/2020/01/get-ready-for-new-samesitenone-secure Get Ready for New SameSite=None; Secure Cookie Settings] 2020-01-26 from Google
+* [https://developers.google.com/search/blog/2020/01/get-ready-for-new-samesitenone-secure Get Ready for New SameSite=None; Secure Cookie Settings] 2020-01-26 from Google. With Chrome 80 in 2020-02, Chrome will treat cookies that have no declared SameSite value as SameSite=Lax cookies.
 ==References==

← Older revision		Revision as of 06:39, 28 January 2024
Line 59:		Line 59:

	The browser changes from 2020 to cookie sameSite properties also made it so that a server that wishes to support POST at its authorization endpoint needs to relax its cookie settings to sameSite: "none" explicitly in order for the received POST request to carry the server's previous cookies. This is unfortunate because the default "lax" behavior is generally more secure and aids in limiting unintended exposure to cross site request forgery.		The browser changes from 2020 to cookie sameSite properties also made it so that a server that wishes to support POST at its authorization endpoint needs to relax its cookie settings to sameSite: "none" explicitly in order for the received POST request to carry the server's previous cookies. This is unfortunate because the default "lax" behavior is generally more secure and aids in limiting unintended exposure to cross site request forgery.
		+
		+	* [https://developers.google.com/search/blog/2020/01/get-ready-for-new-samesitenone-secure Get Ready for New SameSite=None; Secure Cookie Settings] 2020-01-26 from Google

	==References==		==References==

@@ Line 53: / Line 53: @@
 CORS failures result in errors but for security reasons, specifics about the error are not available to JavaScript. All the code knows is that an error occurred 1. The only way to determine what specifically went wrong is to look at the browser’s console for details.<ref>Mozilla, ''Cross-Origin Resource Sharing (CORS)'' https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS</ref>
-==COEP==
+===COEP===
 Cross-Origin-Embedder-Policy (COEP) is an HTTP-header based mechanism that allows a server to indicate any origins other than its own from which a browser should permit loading resources. COEP is used to prevent a document from loading cross-origin resources that don’t explicitly grant the document permission with Cross-Origin-Resource-Policy (CORP) or Cross-Origin Resource Sharing (CORS). COEP lets you declare that a document cannot load these resources.<ref>Mozilla, ''Cross-Origin-Embedder-Policy'' https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy</ref>
 ==References==

@@ Line 54: / Line 54: @@
 ==COEP==
-Cross-Origin-Embedder-Policy (COEP) is an HTTP-header based mechanism that allows a server to indicate any origins other than its own from which a browser should permit loading resources. COEP is used to prevent a document from loading cross-origin resources that don’t explicitly grant the document permission with Cross-Origin-Resource-Policy (CORP) or Cross-Origin Resource Sharing (CORS) 2. COEP lets you declare that a document cannot load these resources.<ref>Mozilla, ''Cross-Origin-Embedder-Policy'' https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy</ref>
+Cross-Origin-Embedder-Policy (COEP) is an HTTP-header based mechanism that allows a server to indicate any origins other than its own from which a browser should permit loading resources. COEP is used to prevent a document from loading cross-origin resources that don’t explicitly grant the document permission with Cross-Origin-Resource-Policy (CORP) or Cross-Origin Resource Sharing (CORS). COEP lets you declare that a document cannot load these resources.<ref>Mozilla, ''Cross-Origin-Embedder-Policy'' https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy</ref>
 ==References==
 <references />

@@ Line 53: / Line 53: @@
 CORS failures result in errors but for security reasons, specifics about the error are not available to JavaScript. All the code knows is that an error occurred 1. The only way to determine what specifically went wrong is to look at the browser’s console for details.<ref>Mozilla, ''Cross-Origin Resource Sharing (CORS)'' https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS</ref>
 ==References==
 <references />

@@ Line 49: / Line 49: @@
 ==CORS==
-Cross-Origin Resource Sharing (CORS) is a mechanism that allows restricted resources on a web page to be accessed from another domain outside the domain from which the first resource was served 12. CORS is an HTTP-header based mechanism that allows a server to indicate any origins (domain, scheme, or port) other than its own from which a browser should permit loading resources. This mechanism relies on a mechanism by which browsers make a “preflight” request to the server hosting the cross-origin resource, in order to check that the server will permit the actual request. In that preflight, the browser sends headers that indicate the HTTP method and headers that will be used in the actual request.
+Cross-Origin Resource Sharing (CORS) is a mechanism that allows restricted resources on a web page to be accessed from another domain outside the domain from which the first resource was served. CORS is an HTTP-header based mechanism that allows a server to indicate any origins (domain, scheme, or port) other than its own from which a browser should permit loading resources. This mechanism relies on a mechanism by which browsers make a “preflight” request to the server hosting the cross-origin resource, in order to check that the server will permit the actual request. In that preflight, the browser sends headers that indicate the HTTP method and headers that will be used in the actual request.
 CORS failures result in errors but for security reasons, specifics about the error are not available to JavaScript. All the code knows is that an error occurred 1. The only way to determine what specifically went wrong is to look at the browser’s console for details.<ref>Mozilla, ''Cross-Origin Resource Sharing (CORS)'' https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS</ref>
 ==References==
 <references />

@@ Line 50: / Line 50: @@
 ==References==
 <references /.
-==Other Materiel==
+===Other Materiel===
 * [https://stackoverflow.com/questions/10636611/how-does-the-access-control-allow-origin-header-work from stack overflow] with lots of germane responses.
 * See wiki page on [[Cross-Origin iFrame]]
 [[Category: Browser]]