Questions tagged [cross-origin]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
1answer
27 views

Using IIS 10 (PHP yes) what is the best practice for allowing iframes of a site?

I have a W2016 server with IIS 10 running on it and I am having problems implementing policy (used to apache) on how to add in the correct headers for Content Security Policy/CORS/X-frame. It seems ...
1
vote
0answers
141 views

Screaming Frog reports internal links are unsafe cross-origin

I've just run a Screaming Frog spider against a client's website and it has returned 370 links that are Unsafe Cross-Origin Links. However when I have investigated the links they don't match the ...
0
votes
0answers
10 views

Can someone explain the requirements on both sides to share an iframe that requires a login (cookie/token to be passed)?

We had many of our websites behind custom SSO up until recently. So we controlled the server and headers and all of that good stuff. Also this is before browsers started cracking down further (...
1
vote
0answers
10 views

Does the same site cookie policy potentially change anything for CORS

According to the new same-site cookie policy (once implemented across all browsers) , a third party call from another page would not send along the cookies by default, unless the third party ...
4
votes
0answers
2k views

AdSense causing cross-origin read blocking (CORB) warnings in Chrome console log

I have 1 ad unit and 2 link units of several pages of my site. On these pages, the loading of ads is good. However, when viewing console log in chrome (F12), I am seeing CORB warnings. Interestingly ...
1
vote
1answer
462 views

Is CORS required for SEO?

I have created a web application and I want the website to optimized for Search Engines. So, do i need to provide Cross Origin Resource Sharing functionality within my site in order to allow the ...
2
votes
2answers
129 views

Is this document write of content fetched from another site cross site scripting or something different?

This was on a website I had to work on. It seems to me its a horrible idea, but I was hoping to get other input before I told them it was. var url = 'https://www.otherdomain.com/magic_php_file.php'; ...
1
vote
1answer
2k views

Chrome reports a cross-origin font issue despite Access-Control-Allow-Origin header

Chrome: "Font from origin 'https://example.com' has been blocked from loading by Cross-Origin Resource Sharing policy: No 'Access-Control-Allow-Origin' header is present on the requested ...
18
votes
4answers
13k views

When should I use the “crossorigin” attribute on a “preconnect” <link>?

I’d like to include some preconnect resource hints on my site so that browsers can (for example) connect to the jQuery CDN before they actually see the script tag that invokes the CDN. I’m not sure ...
5
votes
1answer
2k views

XSRF Error when link is opened via an <a> tag with target attribute set to “_blank”

I've run into a peculiar bug that I have not faced before. I can provide any details that are needed but I'll try to be as generic as possible. We have a intranet portal that links off to other ...
0
votes
1answer
344 views

Why does Google Cache break my iframes?

In HTML5, iframe comes as a replacement for frameset. However, when I load my iframe-based page in SeaMonkey through Google Cache, the page appears empty, other than the standard Google Cache header ...
2
votes
2answers
6k views

How do I automatically log my users into other websites after they have given me their passwords?

I have to program an application where the users can connect to other websites. For example, the user clicks on the "Amazon" button and the application opens the Amazon website. It then needs to pre-...
1
vote
1answer
2k views

Not downloading a file if download URL uses different localhost port

I have a text file and want to download it. I am working in localhost. The HTML page from which I am downloading file, is called from localhost:8080. And the file which I want to download, I am ...
1
vote
1answer
1k views

Font not loading due to cross origin error despite cross origin header and local file

I have a CMS which uses tinymce with elfinder. On the computer of one of my clients elfinder wont load. I checked it on his computer and the only thing I can find is this error: Font from origin ...
6
votes
1answer
671 views

What's the point of cross-origin resource sharing if there's a bunch of CORS proxies running?

I never really liked the direction CORS (cross-origin resource sharing) is taking. I think there's a misconception how client-server communication should work. The general concept is: User: Hello ...