Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

for clearing doubts regarding paragraph in CORS article https://portswigger.net/web-security/cors

sanjogc | Last updated: Aug 12, 2022 01:41PM UTC

Intranets and CORS without credentials Most CORS attacks rely on the presence of the response header: Access-Control-Allow-Credentials: true "Without that header, the victim user's browser will refuse to send their cookies, meaning the attacker will only gain access to unauthenticated content, which they could just as easily access by browsing directly to the target website." The quoted sentence is little bit confusing to me because the absence of ACAC header means user cannot read the response(authenticated) but the line says the browser wont even send cookies. It would be true only if it was preflight response. please correct me if i am wrong.. i am currently learning CORS

Michelle, PortSwigger Agent | Last updated: Aug 15, 2022 02:28PM UTC