Hacker News Reader

Even a JavaScript initiated POST request will go through. Blocking it would not make a lot of sense, because the attacker could just use the FORM (possibly in an iframe to keep it invisible to the victim).

It is possible that XHR, or common XHR libraries, default to adding some header that makes it a non-standard request, but a fetch() call works.

In Firefox, open a debug console and run

    fetch('https://otherorigin.example.com', {method: 'POST', body: 'blah'})

You will see two things. In the console:

    Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://otherorigin.example.com/. (Reason: CORS request did not succeed).

In the network tab, a HTTP request.

Replace with a URL of a server you control, or run `nc -lnvp 9999` and replace the URL with http://127.0.0.1:9999, to see that the request is indeed being made.

As the author said... few people understand CORS.

View on HN

r = new XMLHttpRequest(); r.withCredentials = true; r.addEventListener('load', function(e) {console.log('loaded: ', this, e);}); r.addEventListener('error', function(e) {console.log('error: ', this, e);}); r.open('GET', 'https://www.google.com'); r.setRequestHeader('Cookie', 'somecookie=somecookievalue') r.send();