what is a good solution for cross domain access? - cross-domain

Question

What is the most secure way of providing cross-domain access ?
what are the trade-offs ?
I know we can set cross origin access headers, but this would need my server to know the list of servers beforehand.

Answer 1

You do not need to know the list of servers before hand as you can set Access-Control-Allow-Origin: *, however this is not as secure as it will allow other sites to make use of your services. So make sure when constructing your headers that you allow Access-Control-Allow-Origin from a restricted list. I just use a regular expression to compare against since we allow from multiple. When I verify that there is a match, I return the request origin back in the header. So if I match on something like web.*energydomain.com and the origin is webservices.energydomain.com, then I pass back Access-Control-Allow-Origin: webservices.energydomain.com This tells the calling service (and anyone listening) that I accept from this origin and only this origin, even If I might accept from webstart.energydomain.com.
So using spring we have created a filter.
#Component
#Order(Ordered.HIGHEST_PRECEDENCE)
public class CORSFilter implements Filter {
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
response.setHeader("Access-Control-Allow-Credentials", "true")
//If this is a pre-flight request, make sure that we are allowing them
if ("OPTIONS" == request.method) {
response.setHeader("Access-Control-Allow-Methods", "GET, PUT, POST, DELETE, OPTIONS")
response.setHeader("Access-Control-Max-Age", "604800")
response.setHeader("Access-Control-Allow-Headers", "Authorization, Origin, X-Requested-With, Content-Type, Accept, Access-Control-Allow-Origin, Vary, Cookie, Key")
//Check to see that the referrer/origin matches the set of allowed origins in the application configuration
String referrer = request.getHeader("Origin")
if (referrer?.matches(ServerProperties.instance.accessControlAllowOriginRegEx)) {
response.setHeader("Access-Control-Allow-Origin", referrer)
}
} else {
//set other headers here and continue chain (we don't bother continuing chain on preflight)
chain.doFilter(request, response)
}
}
You can also do this on htaccess
<FilesMatch "\.(ttf|otf|eot|woff)$">
<IfModule mod_headers.c>
SetEnvIf Origin "http(s)?://(www\.)?(webservices.energydomain.com|webservicesmo.energydomain.com|webservicestest.energydomain.com)$" AccessControlAllowOrigin=$0
Header add Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin
</IfModule>
</FilesMatch>
I prefer attempting to reduce the preflight traffic noise and avoid it all together. In particular, I use xdomain. It was pretty simple for me to setup if using angular or jQuery. On your app server, add a proxy.html as stated in the help on the below link. Add some tags referring to the js files on your "client" and viola, no more pre-flights. This wraps in an iframe to avoid need for cors check. You can still control the origins as you do with the CORS preflights as explained above, it just avoids them alltogether.
https://github.com/jpillora/xdomain