{"id":786,"date":"2013-06-14T10:18:37","date_gmt":"2013-06-14T09:18:37","guid":{"rendered":"https:\/\/securite.intrinsec.com:443\/?p=786"},"modified":"2013-06-14T10:18:37","modified_gmt":"2013-06-14T09:18:37","slug":"html-5-cross-origin-resource-sharing-securiser-communications-interdomaines","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/","title":{"rendered":"HTML5 \u2013 CORS: Securing cross-domain application communications"},"content":{"rendered":"<p><em>Dans le cadre de ses activit\u00e9s de recherche, Intrinsec s&rsquo;est int\u00e9ress\u00e9 aux fonctionnalit\u00e9s et risques introduits par l&rsquo;arriv\u00e9e d&rsquo;HTML5. Ce billet traite des \u00ab\u00a0Cross-Origin Resource Sharing\u00a0\u00bb (CORS) dont la mauvaise utilisation pourrait avoir un impact important sur l&rsquo;application et sur la soci\u00e9t\u00e9 l&rsquo;h\u00e9bergeant.<\/em><\/p>\n<p>Auparavant, par mesure de s\u00e9curit\u00e9, des applications de domaines diff\u00e9rents ne pouvaient pas communiquer de fa\u00e7on bidirectionnelle.\u00a0Un domaine A pouvait ainsi envoyer des donn\u00e9es \u00e0 un second, B, mais ne pouvait pas obtenir de r\u00e9ponse. Plus pr\u00e9cis\u00e9ment, B en fournissait bien, mais le navigateur la refusait, d\u00e9tectant qu&rsquo;il ne s&rsquo;agissait pas d&rsquo;une communication intra-domaine.<\/p>\n<p>Pour plus d\u2019informations sur ces communications intra-domaine, se r\u00e9f\u00e9rer \u00e0 la page Wikip\u00e9dia du W3C sur la <a title=\"SOP\" href=\"http:\/\/www.w3.org\/Security\/wiki\/Same_Origin_Policy\">SOP<\/a>.<\/p>\n<p>L\u2019API CORS est impl\u00e9ment\u00e9e dans tous les moteurs de navigateurs majeurs (Gecko 1.9.1, Webkit, Trident 4.0, Presto) et fournit diff\u00e9rentes directives via de nouveaux en-t\u00eates HTTP (headers), notamment :<\/p>\n<ul>\n<li>\u00ab\u00a0Access-Control-Allow-Origin\u00a0\u00bb : celui-ci permet d&rsquo;indiquer au navigateur les domaines autoris\u00e9s \u00e0 recevoir une r\u00e9ponse du serveur.<\/li>\n<li>\u00ab\u00a0Access-Control-Allow-Credentials\u00a0\u00bb : cet en-t\u00eate indique si les cookies doivent \u00eatre transmis ou non dans la r\u00e9ponse.<\/li>\n<\/ul>\n<p>Notons que, par mesure de s\u00e9curit\u00e9, il n&rsquo;est pas possible de positionner les en-t\u00eates mentionn\u00e9es pr\u00e9c\u00e9demment aux valeurs suivantes dans une m\u00eame r\u00e9ponse :<br \/>\n<code>Access-Control-Allow-Origin: *<br \/>\nAccess-Control-Allow-Credentials: true<\/code><\/p>\n<h1>Concr\u00e8tement, comment utilise-t-on ces headers ?<\/h1>\n<p>Soit un serveur \u00ab\u00a0S\u00a0\u00bb dont le code est le suivant :<br \/>\n<code>&lt;?php<br \/>\nheader(\"Access-Control-Allow-Origin: C\");<br \/>\necho \"response\";<br \/>\n?&gt;<\/code><\/p>\n<p>et soit un client \u00ab\u00a0C\u00a0\u00bb :<br \/>\n<code>&lt;script&gt;<br \/>\nvar http = new XMLHttpRequest();<br \/>\nhttp.open(\"GET\", \"S\");<br \/>\nhttp.onload = function() {<br \/>\nvar response = http.responseText;<br \/>\ndocument.write(response);<br \/>\n}<br \/>\nhttp.send();<br \/>\n&lt;\/script&gt;<br \/>\n<\/code><\/p>\n<p>Ici, C re\u00e7oit bien la r\u00e9ponse de S puisqu&rsquo;il figure parmi les \u00ab\u00a0origin\u00a0\u00bb autoris\u00e9es.<br \/>\n<a href=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2013\/04\/article_intro1.png\"><img fetchpriority=\"high\" decoding=\"async\" class=\"alignnone size-full wp-image-823\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2013\/04\/article_intro1.png\" alt=\"\" width=\"492\" height=\"198\" \/><\/a><\/p>\n<h1>Exemples de mauvaise utilisation du header Access-Control-Allow-Origin ?<\/h1>\n<h2>Autorisation universelle<\/h2>\n<p>Avec la configuration ci-dessous , la page autorise tout \u00e9metteur du COR \u00e0 recevoir une r\u00e9ponse.<br \/>\n<code>header(\"Access-Control-Allow-Origin: *\");<br \/>\n\/\/ actions<\/code><\/p>\n<p>Imaginons le cas de figure suivant : une entreprise dispose d&rsquo;un intranet, uniquement accessible en interne, sur lequel la valeur du header \u00ab\u00a0Access-Control-Allow-Origin\u00a0\u00bb \u00e0 un <em>wildcard<\/em>. Si un employ\u00e9 se connecte \u00e0 un site malveillant depuis l&rsquo;entreprise, ce dernier pourra par exemple effectuer une requ\u00eate Ajax vers l&rsquo;intranet et recevoir les donn\u00e9es de ce dernier, via cette configuration.<\/p>\n<h3>Conclusion<\/h3>\n<p>Si l&rsquo;application dispose d&rsquo;un acc\u00e8s restreint, via un m\u00e9canisme d&rsquo;authentification quelconque, il est imp\u00e9ratif de donner une valeur pr\u00e9cise \u00e0 cet en-t\u00eate. Notons cependant que si ce n&rsquo;est pas le cas, un wildcard peut \u00eatre plac\u00e9. Pour ces applications (ou portions) publiques, le W3C <a title=\"Ouverture des CORS\" href=\"http:\/\/www.w3.org\/wiki\/CORS_Enabled\">recommande d&rsquo;ailleurs <\/a> de les \u00ab\u00a0ouvrir\u00a0\u00bb aux CORS pour permettre \u00e0 des applications de natures et d&rsquo;auteurs diff\u00e9rents de communiquer entre elles.<\/p>\n<h2>Acc\u00e8s contr\u00f4l\u00e9 uniquement par l&rsquo;en-t\u00eate Origin<\/h2>\n<p>Prenons un autre exemple de mauvaise utilisation. La page ci-dessous affiche deux informations diff\u00e9rentes selon l\u2019<em>origin<\/em> de la requ\u00eate. Le contr\u00f4le d&rsquo;acc\u00e8s \u00e0 cette page est effectu\u00e9 en fonction de l&rsquo;origine du navigateur.<\/p>\n<p><code>if (isset($_SERVER[\"HTTP_ORIGIN\"])) {<br \/>\nif ($_SERVER['HTTP_ORIGIN'] == \"http:\/\/A\") {<br \/>\nheader('Access-Control-Allow-Origin: http:\/\/A');<br \/>\necho \"Confidential Data\".<br \/>\n}<br \/>\nelse {<br \/>\necho \"Denied\".<br \/>\n}<br \/>\n}<\/code><\/p>\n<p>Cette protection peut \u00eatre contourn\u00e9e puisque l&rsquo;en-t\u00eate Origin est, comme tout en-t\u00eate HTTP, falsifiable. Elle devrait \u00eatre corrig\u00e9e en n&rsquo;acceptant que les requ\u00eates transmettant le cookie authentifiant de l&rsquo;utilisateur (avec le <em>Credentials Flag<\/em>, pour les requ\u00eates Ajax par exemple). Si ce cookie est consid\u00e9r\u00e9 comme valide et s&rsquo;il y a pr\u00e9sence d\u2019un jeton (valide), la requ\u00eate pourra alors \u00eatre trait\u00e9e.<\/p>\n<h1>Sc\u00e9nario d&rsquo;attaque : CSRF \u00ab\u00a0silencieuse\u00a0\u00bb<\/h1>\n<p>Soient trois protagonistes : un utilisateur A ayant un compte sur un site B (et par cons\u00e9quent un cookie de session) et un site malveillant O.<br \/>\nCelui-ci contient le script suivant :<br \/>\n<code>request = new XMLHttpRequest();<br \/>\nrequest.open(\"GET\",\"http:\/\/URL_B\/service.php?buy=apple\",true);<br \/>\nrequest.withCredentials = \"true\";<br \/>\nrequest.onreadystatechange = function() {<br \/>\nif (request.readyState == 4) {<br \/>\nvar response = request.responseText;<br \/>\ndocument.getElementById(\"response\").textContent = response;<br \/>\n}<br \/>\n}<br \/>\nrequest.send();<\/code><\/p>\n<p>De ce fait, d\u00e8s que l&rsquo;utilisateur visite O, une requ\u00eate sera envoy\u00e9e \u00e0 B, par le biais de A. L&rsquo;attribut \u00ab\u00a0withCredentials\u00a0\u00bb fix\u00e9 \u00e0 <em>true<\/em> indique que le cookie de A sera transmis. En ex\u00e9cutant l&rsquo;action \u00ab\u00a0buy\u00a0\u00bb, il y a donc eu CSRF sans que l&rsquo;utilisateur ne la d\u00e9clenche de lui-m\u00eame.<\/p>\n<p><a href=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2013\/04\/article_COR_exemple2.jpg\"><img decoding=\"async\" class=\"alignnone size-full wp-image-923\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2013\/04\/article_COR_exemple2.jpg\" alt=\"\" width=\"561\" height=\"283\" \/><\/a><\/p>\n<p>Une protection d\u2019un point de vue serveur contre ce type d\u2019attaques est l\u2019utilisation de jetons (tokens).<\/p>\n<p>Pour rappel, un jeton, g\u00e9n\u00e9r\u00e9 al\u00e9atoirement, est attribu\u00e9 \u00e0 un utilisateur et stock\u00e9 c\u00f4t\u00e9 serveur, rattach\u00e9 \u00e0 l&rsquo;objet repr\u00e9sentant l&rsquo;utilisateur. Il est aussi communiqu\u00e9 au client dans des cas comme celui \u00e9tudi\u00e9 ci-dessus.<br \/>\nIci, le jeton serait ins\u00e9r\u00e9 dans le formulaire et, lors de sa validation, le serveur s&rsquo;assurerait de son authenticit\u00e9.<\/p>\n<h1>Pentesting<\/h1>\n<p>Comment v\u00e9rifier qu&rsquo;un site ou une application est vuln\u00e9rable \u00e0 une usurpation d&rsquo;Origin ?<br \/>\nDans un premier temps, il est n\u00e9cessaire de conna\u00eetre la valeur de l&rsquo;en-t\u00eate Origin attendue par l&rsquo;application. Les valeurs de celle-ci et du header sont souvent les m\u00eames.<br \/>\nSi les deux commandes ci-dessous diff\u00e8rent par le contenu du fichier t\u00e9l\u00e9charg\u00e9, alors l&rsquo;application est vuln\u00e9rable :<br \/>\n<code>wget --header=\"Origin: BonDomaine\" URL<br \/>\nwget --header=\"Origin: MauvaisDomaine\" URL<\/code><\/p>\n<p><strong>Que faut-il en retenir ?<\/strong><br \/>\n&#8211; Il est fortement d\u00e9conseill\u00e9 d&rsquo;utiliser les wildcards d\u00e8s lors qu&rsquo;il y a restriction d&rsquo;acc\u00e8s;<br \/>\n&#8211; cependant, si aucune authentification n&rsquo;est n\u00e9cessaire, il est possible de l&rsquo;ouvrir via un wildcard;<br \/>\n&#8211; ne pas se fier uniquement \u00e0 l&rsquo;en-t\u00eate Origin : utiliser un syst\u00e8me de cookies et de tokens;<\/p>\n<h1>R\u00e9f\u00e9rences<\/h1>\n<p><a title=\"De la s\u00e9curit\u00e9 des CORS\" href=\"http:\/\/code.google.com\/p\/html5security\/wiki\/CrossOriginRequestSecurity\">De la s\u00e9curit\u00e9 des CORS<\/a><br \/>\n<a title=\"Silent CSRF\" href=\"http:\/\/evil-bit.blogspot.fr\/2012\/07\/html5-xhr-and-silent-csrf.html\">Silent CSRF<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Dans le cadre de ses activit\u00e9s de recherche, Intrinsec s&rsquo;est int\u00e9ress\u00e9 aux fonctionnalit\u00e9s et risques [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":1061,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[92,93,94],"class_list":["post-786","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-non-categorise","tag-cors","tag-cross-origin-resource-sharing","tag-html5"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.0 (Yoast SEO v28.1) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>HTML5 - CORS : S\u00e9curiser les communications applicatives interdomaines - INTRINSEC<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intrinsec.com\/en\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"HTML5 - CORS : S\u00e9curiser les communications applicatives interdomaines\" \/>\n<meta property=\"og:description\" content=\"Dans le cadre de ses activit\u00e9s de recherche, Intrinsec s&rsquo;est int\u00e9ress\u00e9 aux fonctionnalit\u00e9s et risques [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intrinsec.com\/en\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/\" \/>\n<meta property=\"og:site_name\" content=\"INTRINSEC\" \/>\n<meta property=\"article:published_time\" content=\"2013-06-14T09:18:37+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/03\/About-Us-Subscribe-BG.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"681\" \/>\n\t<meta property=\"og:image:height\" content=\"694\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Intrinsec\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:site\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Intrinsec\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\\\/\"},\"author\":{\"name\":\"Intrinsec\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/ade590fbc7ad6f413727bae7cd3fb799\"},\"headline\":\"HTML5 &#8211; CORS : S\u00e9curiser les communications applicatives interdomaines\",\"datePublished\":\"2013-06-14T09:18:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\\\/\"},\"wordCount\":888,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/About-Us-Subscribe-BG.webp\",\"keywords\":[\"cors\",\"cross-origin resource sharing\",\"html5\"],\"articleSection\":[\"Non cat\u00e9goris\u00e9\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\\\/\",\"name\":\"HTML5 - CORS : S\u00e9curiser les communications applicatives interdomaines - INTRINSEC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/About-Us-Subscribe-BG.webp\",\"datePublished\":\"2013-06-14T09:18:37+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/About-Us-Subscribe-BG.webp\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/About-Us-Subscribe-BG.webp\",\"width\":681,\"height\":694},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.intrinsec.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"HTML5 &#8211; CORS : S\u00e9curiser les communications applicatives interdomaines\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"name\":\"INTRINSEC\",\"description\":\"Notre m\u00e9tier , Prot\u00e9ger le v\u00f4tre\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intrinsec.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\",\"name\":\"INTRINSEC\",\"alternateName\":\"ISEC\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"width\":1322,\"height\":1322,\"caption\":\"INTRINSEC\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Intrinsec\",\"https:\\\/\\\/fr.linkedin.com\\\/company\\\/intrinsec\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UC0trUZAHNZOUbxYnNdecM4A\"],\"description\":\"soci\u00e9t\u00e9 de consulting, pure player cybers\u00e9curit\u00e9 fran\u00e7ais et europ\u00e9en depuis plus de 30ans, sp\u00e9cialiste dans la s\u00e9curit\u00e9 offensive & audit (pentest\\\/red team), GRC, et services IMSS comme le SOC, CTI et CERT Intrinsec est qualifi\u00e9 PASSI Elev\u00e9, PRIS Elev\u00e9 et PACS par l'ANSSI\",\"email\":\"contact@intrinsec.com\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/ade590fbc7ad6f413727bae7cd3fb799\",\"name\":\"Intrinsec\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g\",\"caption\":\"Intrinsec\"},\"sameAs\":[\"https:\\\/\\\/www.intrinsec.com\"],\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/author\\\/ufhtbqccsz\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"HTML5 - CORS: Securing inter-domain application communications - INTRINSEC","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intrinsec.com\/en\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/","og_locale":"en_US","og_type":"article","og_title":"HTML5 - CORS : S\u00e9curiser les communications applicatives interdomaines","og_description":"Dans le cadre de ses activit\u00e9s de recherche, Intrinsec s&rsquo;est int\u00e9ress\u00e9 aux fonctionnalit\u00e9s et risques [&hellip;]","og_url":"https:\/\/www.intrinsec.com\/en\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/","og_site_name":"INTRINSEC","article_published_time":"2013-06-14T09:18:37+00:00","og_image":[{"width":681,"height":694,"url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/03\/About-Us-Subscribe-BG.webp","type":"image\/webp"}],"author":"Intrinsec","twitter_card":"summary_large_image","twitter_creator":"@Intrinsec","twitter_site":"@Intrinsec","twitter_misc":{"Written by":"Intrinsec","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intrinsec.com\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/#article","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/"},"author":{"name":"Intrinsec","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/ade590fbc7ad6f413727bae7cd3fb799"},"headline":"HTML5 &#8211; CORS : S\u00e9curiser les communications applicatives interdomaines","datePublished":"2013-06-14T09:18:37+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intrinsec.com\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/"},"wordCount":888,"commentCount":0,"publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"image":{"@id":"https:\/\/www.intrinsec.com\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/03\/About-Us-Subscribe-BG.webp","keywords":["cors","cross-origin resource sharing","html5"],"articleSection":["Non cat\u00e9goris\u00e9"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.intrinsec.com\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.intrinsec.com\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/","url":"https:\/\/www.intrinsec.com\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/","name":"HTML5 - CORS: Securing inter-domain application communications - INTRINSEC","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intrinsec.com\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/#primaryimage"},"image":{"@id":"https:\/\/www.intrinsec.com\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/03\/About-Us-Subscribe-BG.webp","datePublished":"2013-06-14T09:18:37+00:00","breadcrumb":{"@id":"https:\/\/www.intrinsec.com\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intrinsec.com\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/#primaryimage","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/03\/About-Us-Subscribe-BG.webp","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/03\/About-Us-Subscribe-BG.webp","width":681,"height":694},{"@type":"BreadcrumbList","@id":"https:\/\/www.intrinsec.com\/html-5-cross-origin-resource-sharing-securiser-communications-interdomaines\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.intrinsec.com\/"},{"@type":"ListItem","position":2,"name":"HTML5 &#8211; CORS : S\u00e9curiser les communications applicatives interdomaines"}]},{"@type":"WebSite","@id":"https:\/\/www.intrinsec.com\/#website","url":"https:\/\/www.intrinsec.com\/","name":"INTRINSEC","description":"Our job is to protect yours.","publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intrinsec.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.intrinsec.com\/#organization","name":"INTRINSEC","alternateName":"ISEC","url":"https:\/\/www.intrinsec.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","width":1322,"height":1322,"caption":"INTRINSEC"},"image":{"@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Intrinsec","https:\/\/fr.linkedin.com\/company\/intrinsec","https:\/\/www.youtube.com\/channel\/UC0trUZAHNZOUbxYnNdecM4A"],"description":"Intrinsec, a consulting firm and pure-play French and European cybersecurity provider for over 30 years, specializes in offensive security and auditing (penetration testing\/red teams), GRC, and IMSS services such as SOC, CTI, and CERT. Intrinsec is qualified at PASSI High, PRIS High, and PACS levels by ANSSI.","email":"contact@intrinsec.com"},{"@type":"Person","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/ade590fbc7ad6f413727bae7cd3fb799","name":"Intrinsic","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g","caption":"Intrinsec"},"sameAs":["https:\/\/www.intrinsec.com"],"url":"https:\/\/www.intrinsec.com\/en\/author\/ufhtbqccsz\/"}]}},"_links":{"self":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/786","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/comments?post=786"}],"version-history":[{"count":0,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/786\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media\/1061"}],"wp:attachment":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media?parent=786"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/categories?post=786"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/tags?post=786"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}