CORS Proof of Concept
Getting data from a completely different domain without XSS headaches… CORS awesomeness is awesome!
Server:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
// access control. If doesn't contains jshell.net, forbid $origin = $_SERVER['HTTP_ORIGIN']; if(strpos($origin, 'jshell.net')){ header("Access-Control-Allow-Origin: {$origin}"); header("Access-Control-Allow-Headers: content-type, accept"); header("Access-Control-Max-Age: 10"); // seconds header('Content-type: application/json'); // business "logic" if(isset($_GET['age'])){ print '{"whatever" : {"age" : "'. $_GET['age'] .'"}}'; } else { print '{"whatever" : {"ip" : "'.$_SERVER['REMOTE_ADDR'].'"}}'; } } else { header('HTTP/1.0 400 Bad Request', true, 400); } |