Re: CORS Findings

2011-07-11 Thread Anne van Kesteren
On Mon, 11 Jul 2011 01:09:44 +0200, Ashar Javed wrote: 1) Access-Control-Allow-Origin: *. In the above case I am getting in response *. (dot after *). Is it fine or typo? Typo, will not work. 2) For another website I am getting in response Access-Control: allow <*> Old syntax, will n

CORS Findings

2011-07-11 Thread Ashar Javed
Hi, I am now a days working on analyzing the deployment of CORS in wild. By having a crawl I have found some interesting cases. About the following cases can we say that the sites are using CORS in wrong manner: The cases are: 1) Access-Control-Allow-Origin: *. In the above case I am getting in