Robuta

https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS Cross-Origin Resource Sharing (CORS) - HTTP | MDN Cross-Origin Resource Sharing (CORS) is an HTTP-header based mechanism that allows a server to indicate any origins (domain, scheme, or port) other than its... cross originresource sharingcorshttpmdn https://en.wikipedia.org/wiki/Cross-origin_resource_sharing Cross-origin resource sharing - Wikipedia cross originresource sharingwikipedia https://enable-cors.org/ enable cross-origin resource sharing cross originenableresourcesharing https://andrewlock.net/understanding-security-headers-part-1-cross-origin-opener-policy-preventing-attacks-from-popups/ Cross-Origin-Opener-Policy: preventing attacks from popups In this post I describe the vulnerabilities in window.opener and window.open() and how to protect yourself with Cross-Origin-Opener-Policy cross originopenerpolicypreventingattacks https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy Cross-Origin-Opener-Policy (COOP) header - HTTP | MDN The HTTP Cross-Origin-Opener-Policy (COOP) response header allows a website to control whether a new top-level document, opened using Window.open() or by... cross originopenerpolicycoopheader https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy Cross-Origin-Embedder-Policy (COEP) header - HTTP | MDN The HTTP Cross-Origin-Embedder-Policy (COEP) response header configures the current document's policy for loading and embedding cross-origin resources that are... cross originembedderpolicycoepheader https://enable-cors.org/server.html enable cross-origin resource sharing cross originenableresourcesharing https://groups.google.com/a/chromium.org/g/blink-dev/c/CyGHPL8Z6IY/m/MfAK9NepAAAJ Intent to Experiment: Prerendering cross-origin iframes intent to experimentcross originprerenderingiframes https://advisories.gitlab.com/maven/org.asynchttpclient/async-http-client/GHSA-cmxv-58fp-fm3g/ AsyncHttpClient leaks authorization credentialsto untrusted domains on cross-origin redirects |... GHSA-cmxv-58fp-fm3g AsyncHttpClient leaks authorization credentialsto untrusted domains on cross-origin redirects: When redirect following is enabled... cross originleaksauthorizationdomainsredirects https://groups.google.com/a/chromium.org/g/blink-dev/c/hTOXiBj3D6A/m/JtkdpDd1BAAJ Intent to Remove: Cross origin subframe JS Dialogs cross originintentremovesubframejs https://magicmac.github.io/blog/2011-07-22-uxss-vbscript-error-bubbles-up-get-constructor/ UXSS: VBScript Error Bubbles Up to Expose Cross-Origin Constructor up tocross originuxssvbscripterror https://andrewlock.net/understanding-security-headers-part-3-cross-origin-embedder-policy/ Cross-Origin-Embedder-Policy: securing embedded resources In this post I discuss the Cross-Origin-Embedder-Policy, the requirements it places on your resources, and why it's required for some JavaScript APIs cross originembedderpolicysecuringembedded https://web.developers.google.cn/articles/cross-origin-isolation-guide A guide to enable cross-origin isolation | Articles | web.dev for China Cross-origin isolation enables a web page to use powerful features such as SharedArrayBuffer. This article explains how to enable cross-origin isolation on... a guide tocross origin https://web.dev/articles/cross-origin-resource-sharing?authuser=4 Cross-Origin Resource Sharing (CORS) | Articles | web.dev The browser's same-origin policy blocks reading a resource from a different origin for security purposes. Enabling CORS lets the server tell the browser it can... cross originresource sharingarticles webcorsdev https://corsfix.com/ CORS Proxy for solving cross-origin errors | Corsfix Our CORS Proxy is fast and secure. Fetch any resource and solve CORS errors instantly. Start for free and scale as you grow. cors proxycross originsolvingerrorscorsfix https://andrewlock.net/series/understanding-cross-origin-security-headers/ Understanding cross-origin security headers Dec 3, 2024 - In this series I look at some of the security headers you can apply to your applications to enhance your security when interacting with cross-origin resources cross originunderstandingsecurityheaders https://www.sei.cmu.edu/library/cross-origin-resource-sharing-cors/ Cross-Origin Resource Sharing (CORS) | CMU Software Engineering Institute Alex Corn discusses how cross-origin resource sharing (CORS) works to resolve network problems caused by same-origin policy, and how it should be configured. cross originresource sharingsoftware engineeringcorscmu https://advisories.gitlab.com/pypi/prefect/CVE-2024-8183/ Prefect CORS (Cross-Origin Resource Sharing) misconfiguration | GitLab Advisory Database (GLAD) CVE-2024-8183 Prefect CORS (Cross-Origin Resource Sharing) misconfiguration: A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect prior... cross originresource sharingprefectcors https://raw.githubusercontent.com/mozilla-firefox/firefox/main/testing/web-platform/tests/resource-timing/font-timestamps.html Test cross-origin fetch redirects have the right values. cross originthe righttestfetchredirects https://developer.chrome.com/docs/extensions/reference/manifest/cross-origin-opener-policy?hl=nl Cross-origin openerbeleid | Chrome Extensions | Chrome for Developers Referentiedocumentatie voor de eigenschap cross_origin_opener_policy van manifest.json. cross originchrome extensionsdevelopers https://raw.githubusercontent.com/mozilla-firefox/firefox/main/browser/base/content/test/favicons/credentials2.html Favicon test for cross-origin credentials cross originfavicontestcredentials https://web.dev/articles/cross-origin-resource-sharing?authuser=9 Cross-Origin Resource Sharing (CORS) | Articles | web.dev The browser's same-origin policy blocks reading a resource from a different origin for security purposes. Enabling CORS lets the server tell the browser it can... cross originresource sharingarticles webcorsdev https://wicg.github.io/cross-origin-embedder-policy/ Cross-Origin Embedder Policy cross originembedderpolicy https://web.dev/articles/cross-origin-isolation-guide A guide to enable cross-origin isolation | Articles | web.dev Feb 9, 2021 - Cross-origin isolation enables a web page to use powerful features such as SharedArrayBuffer. This article explains how to enable cross-origin isolation on... a guide tocross originarticles webenableisolation https://magicmac.github.io/blog/2010-12-01-ie9-uxss-location-prototype-intercept-legit-methods/ IE9 UXSS: Location.prototype.replace Intercepts Cross-Origin Frame-Breaking cross originuxsslocationprototypereplace https://magicmac.github.io/blog/2013-11-12-uxss-ie11-about-blank-full-access/ UXSS on IE11: Domainless about:blank Full Cross-Origin Access about blankcross originuxssfullaccess https://dev-academy.teachable.com/courses/kit/lectures/27533429 Cross-origin resource sharing | Dev Academy Get confidence in building applications diving deep in Web security model with practical hands-on coding labs cross originresource sharingdevacademy https://lists.whatwg.org/pipermail/whatwg-whatwg.org/2012-December/080633.html [whatwg] Making cross-origin iframe seamless="" (partly) usable cross originwhatwgmakingiframeseamless https://thehackernews.com/2025/05/new-chrome-vulnerability-enables-cross.html?m=0 New Chrome Vulnerability Enables Cross-Origin Data Leak via Loader Referrer Policy Chrome flaw CVE-2025-4664 enables cross-origin data leaks; active exploit confirmed; update to 136.0.7103.113. cross origin https://groups.google.com/g/roaddigitrafficfi/c/O8rr7FS-v9Q Cross-Origin Request Blocked from tie.digitraffic.fi cross originrequestblockedtiedigitraffic https://advisories.gitlab.com/npm/openclaw/CVE-2026-40037/ OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects | GitLab... CVE-2026-40037 OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects: fetchWithSsrFGuard replays unsafe request bodies... cross originopenclawreplaysunsaferequest https://advisories.gitlab.com/pypi/glances/CVE-2026-34839/ Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to... CVE-2026-34839 Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS: The Glances web server exposes a REST... cross origininformation disclosure https://bugzilla.mozilla.org/show_bug.cgi?id=1785379 1785379 - Intermittent /html/cross-origin-opener-policy/resource-popup.https.html | single tracking... cross origin https://magicmac.github.io/blog/2010-09-02-ie9-uxss-defineproperty-intercept-legit-methods/ IE9 UXSS: Object.defineProperty Intercepts Cross-Origin Navigation cross originuxssobjectdefinepropertyintercepts https://docs.nginx.com/nginx-gateway-fabric/traffic-security/cors/ Configure Cross-Origin Request Sharing (CORS) | NGINX Documentation Learn how to deliver, manage, and protect your applications using F5 NGINX products. cross originconfigurerequestsharingcors https://magicmac.github.io/blog/2009-04-21-flash-geturl-subframe-navigation/ Flash getURL Cross-Origin Sub-Frame Navigation cross originsub frameflashgeturlnavigation https://raw.githubusercontent.com/mozilla-firefox/firefox/main/browser/base/content/test/favicons/credentials1.html Favicon test for cross-origin credentials cross originfavicontestcredentials https://magicmac.github.io/blog/2010-09-03-uxss-cached-childnodes-redirect/ UXSS: Cached childNodes Collection Survives Cross-Origin Redirect cross originuxsscachedcollectionredirect https://aws.amazon.com/what-is/cross-origin-resource-sharing/ What is CORS? - Cross-Origin Resource Sharing Explained - AWS Learn what CORS is and how to use Cross-Origin Resource Sharing with AWS. what iscross originresource sharingcorsexplained https://dev.to/jonesrussell/cors-fix-cross-origin-issues-32j6 CORS: Fix Cross-Origin Issues - DEV Community Ahnii! CORS (Cross-Origin Resource Sharing) lets your API accept requests from different domains.... Tagged with go, webdev, cors, api. cross origincorsfixissuesdev https://developer.chrome.com/docs/extensions/mv2/manifest/cross-origin-embedder-policy?authuser=4 Cross-origin embedder policy | Manifest V2 | Chrome for Developers Reference documentation for the cross_origin_embedder_policy property of manifest.json. cross originembedderpolicymanifestchrome https://magicmac.github.io/blog/2010-07-28-ie9-uxss-self-window-frames-reference/ IE9 UXSS: Accessing Cross-Origin Content via window.self cross originuxssaccessingcontentvia https://groups.google.com/a/chromium.org/g/blink-dev/c/Iw3_SUcagGg?hl=ru Intent to Deprecate and Remove: Block cross-origin a download remove blockcross originintentdeprecatedownload https://web.dev/articles/cross-origin-resource-sharing?authuser=5 Cross-Origin Resource Sharing (CORS) | Articles | web.dev The browser's same-origin policy blocks reading a resource from a different origin for security purposes. Enabling CORS lets the server tell the browser it can... cross originresource sharingarticles webcorsdev https://lists.whatwg.org/pipermail/whatwg-whatwg.org/2012-December/080538.html [whatwg] Making cross-origin iframe seamless="" (partly) usable cross originwhatwgmakingiframeseamless https://advisories.gitlab.com/pypi/feast/CVE-2024-11602/ Feast Cross-Origin Resource Sharing vulnerability | GitLab Advisory Database (GLAD) CVE-2024-11602 Feast Cross-Origin Resource Sharing vulnerability: A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version... cross originresource sharingfeastvulnerabilitygitlab https://spring.io/guides/gs/rest-service-cors/ Getting Started | Enabling Cross Origin Requests for a RESTful Web Service Learn how to create a RESTful web service with Spring that support Cross-Origin Resource Sharing (CORS). getting startedcross originenabling https://chrome.dev/f/cross-origin-isolation// Cross-Origin Isolation Playground A cool thing made with Glitch cross originisolationplayground https://docs.cloud.google.com/storage/docs/cross-origin?hl=id Cross-Origin Resource Sharing (CORS) | Cloud Storage | Google Cloud Documentation cross originresource sharingcloud storagecorsgoogle https://advisories.gitlab.com/pypi/agentscope/CVE-2024-8487/ AgentScope Cross-Origin Resource Sharing (CORS) vulnerability | GitLab Advisory Database (GLAD) CVE-2024-8487 AgentScope Cross-Origin Resource Sharing (CORS) vulnerability: A Cross-Origin Resource Sharing (CORS) vulnerability exists in... cross originresource sharingagentscope https://magicmac.github.io/blog/2013-12-24-docmode8-checks-existence-of-cross-origin-members/ DocMode 8: Checking Cross-Origin Variable Existence via ACCESS_DENIED cross origincheckingvariableexistencevia https://drstearns.github.io/tutorials/cors/ Cross-Origin Resource Sharing Enable JavaScript from different origins to call your APIs cross originresourcesharing https://groups.google.com/a/chromium.org/g/blink-dev/c/5nvBAjmoO2g/m/zkKy9EmxCAAJ Intent to Ship: Protected Audience: cross-origin trusted signals fetches intent to shipcross originprotectedaudiencetrusted https://groups.google.com/a/chromium.org/g/blink-dev/c/Iw3_SUcagGg?hl=tr Intent to Deprecate and Remove: Block cross-origin a download remove blockcross originintentdeprecatedownload https://lists.whatwg.org/pipermail/whatwg-whatwg.org/2012-December/038216.html [whatwg] Making cross-origin iframe seamless="" (partly) usable cross originwhatwgmakingiframeseamless https://developer.chrome.com/docs/extensions/mv2/manifest/cross-origin-embedder-policy?hl=nl Cross-origin inbedbeleid | Manifest V2 | Chrome for Developers Referentiedocumentatie voor de eigenschap cross_origin_embedder_policy van manifest.json. cross originmanifestchromedevelopers https://web.dev/articles/cross-origin-isolation-guide?authuser=5 A guide to enable cross-origin isolation | Articles | web.dev Cross-origin isolation enables a web page to use powerful features such as SharedArrayBuffer. This article explains how to enable cross-origin isolation on... a guide tocross originarticles webenableisolation https://web.dev/articles/coop-coep Making your website "cross-origin isolated" using COOP and COEP | Articles | web.dev Apr 13, 2020 - Some web APIs increase the risk of side-channel attacks like Spectre. To mitigate that risk, browsers offer an opt-in-based isolated environment called... https://www.pcgamer.com/origin-update-introduces-fps-counter-and-cross-party-invites/ Origin update introduces FPS counter and cross-party invites | PC Gamer Jun 20, 2017 - You can also now manage your download speed. party invitesoriginupdateintroducesfps https://advisories.gitlab.com/pypi/urllib3/CVE-2024-37891/ urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects | GitLab... CVE-2024-37891 urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects: When using urllib3's proxy support with ProxyManager,... https://advisories.gitlab.com/npm/undici/CVE-2022-31151/ Uncleared cookies on cross-host / cross-origin redirect | GitLab Advisory Database (GLAD) CVE-2022-31151 Uncleared cookies on cross-host / cross-origin redirect: Authorization headers are cleared on cross-origin redirect. However, cookie headers... cookiescrosshost https://lists.w3.org/Archives/Public/public-html-bugzilla/2010Apr/0641.html [Bug 7709] Prevent PUT/DELETE cross-origin from bugzilla@jessica.w3.org on 2010-04-19... https://lists.w3.org/Archives/Public/www-archive/2012Mar/0011.html Re: Transition Request: Cross-Origin Resource Sharing (CORS) to Last Call from Thomas Roessler on... https://advisories.gitlab.com/cargo/deno_fetch/CVE-2025-21620/ fetch: Authorization headers not dropped when redirecting cross-origin | GitLab Advisory Database... CVE-2025-21620 fetch: Authorization headers not dropped when redirecting cross-origin: When you send a request with the Authorization header to one domain, and... https://bugzilla.mozilla.org/show_bug.cgi?id=1893314 1893314 - [wpt-sync] Sync PR 45890 - [shared storage] Add a WPT to test cross-origin worklet... RESOLVED (wptsync) in Testing - web-platform-tests. Last updated 2024-04-29. https://advisories.gitlab.com/golang/github.com/patrickhener/goshs/v2/GHSA-rhf7-wvw3-vjvm/ goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS | GitLab... GHSA-rhf7-wvw3-vjvm goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS: The PUT upload handler (httpserver/updown.go) lacks... https://advisories.gitlab.com/cargo/deno/CVE-2025-21620/ fetch: Authorization headers not dropped when redirecting cross-origin | GitLab Advisory Database... CVE-2025-21620 fetch: Authorization headers not dropped when redirecting cross-origin: When you send a request with the Authorization header to one domain, and... https://developer.chrome.com/blog/referrer-policy-new-chrome-default/?authuser=3 A new default Referrer-Policy for Chrome - strict-origin-when-cross-origin | Blog | Chrome for... A new default Referrer-Policy for Chrome - strict-origin-when-cross-origin a newreferrer policyfor chrome https://lists.w3.org/Archives/Public/public-rww/2011Sep/0046.html Re: cross-origin webdav with TLS client certs (was Re: [unhosted] data.fm now accepts multiple... https://lists.w3.org/Archives/Public/public-webapps/2011JanMar/0713.html Re: Cross-Origin Resource Embedding Restrictions from Maciej Stachowiak on 2011-03-01... https://magicmac.github.io/blog/2011-07-05-ie10-workers-load-redirected-url/ IE10 Workers Load Redirected URL (Cross-Origin) workersloadredirectedurlcross https://community.f5.com/kb/technicalarticles/f5-distributed-cloud---mitigation-for-cross-tenant-origin-exposure-ctoe/335634/comments/335906 F5 Distributed Cloud - Mitigation for Cross Tenant Origin Exposure (CTOE) | DevCentral Oct 28, 2024 - F5 Distributed Cloud (XC) offers a suite of powerful features designed to simplify the lives of administrators and engineers. A key aspect of this ease of... distributed cloudmitigation https://advisories.gitlab.com/npm/@tinacms/cli/CVE-2026-28792/ TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration +... CVE-2026-28792 TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS: The TinaCMS CLI dev... https://hengdalock.en.made-in-china.com/product/PShECwNTrUkb/China-Yh1741-Universal-Cross-Steel-Key-Material-Origin-Type-Gua-Neutral-Main-Place-Model-Car-Steering-Wheel-Lock-Anti-Theft-2-Keys.html Yh1741 Universal Cross Steel Key Material Origin Type Gua Neutral Main Place Model Car Steering... Yh1741 Universal Cross Steel Key Material Origin Type Gua Neutral Main Place Model Car Steering Wheel Lock Anti Theft 2 Keys, Find Details and Price about...