36

I have a common authentication form across multiple subdomains (example.com, blog.example.com, and app.example.com). The login form must submit this data to example.com irrespective of where it is shown, so I thought of using CORS, but this:

header("Access-Control-Allow-Origin: http://example.com http://blog.example.com http://app.example.com")

does not work

So I thought of doing the next thing, and checking the Origin header manually on server side, and allowing a Access-Control-Allow-Origin: * so that requests might be made, but unfortunately, this crops up in the MDN

Important note: when responding to a credentialed request, server must specify a domain, and cannot use wild carding.

Is there any way to make my request work across multiple domains, and still send credentials using CORS ?

2
  • I believe you can also put commas between the domain names. (i.e. so, yes, you can make it work across multiple domains.) Jan 15, 2016 at 6:57
  • 2
    I don't think so. From the spec: >In practice the origin-list-or-null production is more constrained. Rather than allowing a space-separated list of origins, it is either a single origin or the string "null". source
    – Nemo
    Jan 16, 2016 at 6:04

2 Answers 2

49

Two thoughts:

1) are you also including the "Access-Control-Allow-Credentials: true" header? This is needed for passing cookie credentials (and the corresponding XHR client must set .withCredentials = true)

2) Have you tried the suggestion from your link and only include the origin for the current request. For example, if a request comes in with the header "Origin: http://blog.example.com", you would respond with "Access-Control-Allow-Origin: http://blog.example.com", and not a list of origins. This requires a little more work on your server side implementation.

3) One other thought, you mention that you have a single login form that must be shared by various domains. Well, if it is a standard HTML form, you can do a regular form-post across domains. You don't need to use CORS. Just set the "action" property of the form to the url you wish to post to. For example:

<form name="login" action="http://login.example.com/doLogin">
1
  • I ended up using (2). Somehow I had overlooked the single origin method.
    – Nemo
    Nov 10, 2011 at 15:57
2
// cross domain
header("Access-Control-Allow-Origin: ".$_SERVER['HTTP_ORIGIN']);
header('Access-Control-Allow-Credentials: true');
4
  • 11
    Don't do that without a strict verification of the Origin header or you will open security hole
    – Tom
    Aug 18, 2015 at 20:50
  • 7
    This answer illustrates why it's impossible to have fool-proof security -- in technicolor even!! >.< Jan 15, 2016 at 7:00
  • OK appears that this is "in essence" the same as doing "*" which can open up subtle security holes so is discouraged, see stackoverflow.com/questions/12001269/…
    – rogerdpack
    Apr 14, 2017 at 18:26
  • Why not do this: blog.portswigger.net/2016/10/…
    – JSmyth
    Oct 15, 2017 at 2:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.