Chapter 3. Usability and Security

In this chapter, you will learn how to implement CORS in various scenarios to enable access across domain boundaries.

We will discuss the following:

• CORS and XDomainRequest (IE 8 and 9) browser support
• Detecting AJAX support in the browser
• Using preflight to ensure usability and improve security
• The Access-Control-Allow-Origin header, with and without the wildcard
• HTTP request and response headers for usability and security
• CORS requests with credentials, and setting and reading cookies
• The CORS security cheat sheet by OWASP

Note

We use the term client to denote any user agent capable of making a CORS request. Typically, the client is the browser displaying the page making the request.