设置 Access-Control-Allow-Origin 接受所有域存在哪些安全风险?
我最近不得不将 Access-Control-Allow-Origin 设置为 * 以便能够进行跨子域 AJAX 调用.我觉得这可能是一个安全问题.如果我保留该设置，我会面临哪些风险?
I recently had to set Access-Control-Allow-Origin to * in order to be able to make cross-subdomain AJAX calls. I feel like this might be a security problem. What risks am I exposing myself to if I keep the setting?
推荐答案
Access-Control-Allow-Origin: * 可以完全安全地添加到任何资源中，除非该资源包含受标准凭据以外的东西保护的私有数据.标准凭据是 cookie、HTTP 基本身份验证和 TLS 客户端证书.
Access-Control-Allow-Origin: * is totally safe to add to any resource, unless that resource contains private data protected by something other than standard credentials. Standard credentials are cookies, HTTP basic auth, and TLS client certificates.
想象一下https://example.com/users-private-data，这可能会根据用户的登录状态暴露私人数据.此状态使用会话 cookie.将 Access-Control-Allow-Origin: * 添加到此资源是安全，因为此标头仅允许在没有 cookie 的请求和 cookie 的情况下访问响应需要获取私有数据.因此，不会泄露任何私人数据.
Imagine https://example.com/users-private-data, which may expose private data depending on the user's logged in state. This state uses a session cookie. It's safe to add Access-Control-Allow-Origin: * to this resource, as this header only allows access to the response if the request is made without cookies, and cookies are required to get the private data. As a result, no private data is leaked.
想象一下 https://intranet.example.com/company-private-data，它会公开公司的私人数据，但只有在公司的 wifi 网络上才能访问.将 Access-Control-Allow-Origin: * 添加到此资源是不安全，因为它使用标准凭据以外的其他方式进行保护.否则，错误的脚本可能会将您用作通往 Intranet 的隧道.
Imagine https://intranet.example.com/company-private-data, which exposes private company data, but this can only be accessed if you're on the company's wifi network. It's not safe to add Access-Control-Allow-Origin: * to this resource, as it's protected using something other than standard credentials. Otherwise, a bad script could use you as a tunnel to the intranet.
想象一下，如果用户在隐身窗口中访问资源，他们会看到什么.如果您对看到此内容的所有人(包括浏览器收到的源代码)感到满意，则可以安全地添加 Access-Control-Allow-Origin: *.
Imagine what a user would see if they accessed the resource in an incognito window. If you're happy with everyone seeing this content (including the source code the browser received), it's safe to add Access-Control-Allow-Origin: *.
相关文章