What is CORS? | Cross-Origin Resourse Sharing | CORS Explaind in 11min | Intellipaat

foreign [Music] and welcome to intellipad in this video we will be learning about a web technology mechanism called cross origin resource sharing cross-origin resource sharing or cors for short is an HTTP header based mechanism originating from a server the server indicates that other domains schemes or ports other than its own should permit resource loading a web page freely embed cross-original images style sheets scripts iframes and videos let us learn more about cors in this video but before that make sure that you subscribe to our YouTube channel and hit the Bell icon for regular updates alright now let us take a look at the agenda for this video firstly I'll be introducing the concept of course next I'll move on to the need for course the reason why cores came into existence it is basically a mechanism and next I'll move on to the topic how does cars work we have four steps in how course works I'll be explaining each one of them in this section and later I'll be taking up an example of the use case of course that is where it is used in the real world and finally we'll be taking a look at the conclusion of this video now that we are clear with the agenda let us move on to the first topic introduction cross origin resource sharing which is an acronym for cars it is a mechanism that allows restricted resources on the web page to be requested from another domain outside the domain from which the First Resource was served so in simple terms let's say a client from a web browser makes a request to a domain that is basically a server and this first domain is called as domainx.com and let's say we have another domain called domain y.com and the web page you are requesting has some image which is not present in domainx.com it is actually present in domain y.com so how do you get this image so you make a request to domainx.com and in turn it gives you the web page but without the image because the image is present in domain y.com and then you make a request again to another domain which is domainmy.com and if that clears if the security checks are clear then you will be allowed access to the image file that is present in the domain y.com and basically after all these steps that is all the four steps you will get the web page as well as the image embedded on it now let us see an alternative definition in other words coarse is a security mechanism employed by browsers like let's say Firefox Chrome Internet Explorer Etc to prevent the browsers from making calls to another website a request for a resource like an image or a font Etc outside of the origin is known as a cross origin request course is specification it is basically a specification that manages cross-origin requests now let us take a look at the base level explanation that is a naive explanation for it it is like the security guard that prevents a malicious person from entering your premises until they process certain authorization or an ID card let's say and hence keeps your family safe I hope that by this time you guys would have heard of some rough idea of what causes now to make things more clear let us move on to the next topic which is Need for course to prevent websites from tampering with one another web browsers Implement a security measure known as same origin policy now what is the same origin policy this policy lets resources such as JavaScript interact with other resources from the same domain but not with resources from different domains so this is by default the security measures by default is that resources like JavaScript can interact with resources from the same domain and not with different domains this provides security for the user by preventing abuse such as running a script that reads the password field on the secure website so basically this security measure is taken to avoid cross-site scripting or xss in cases where cross domain scripting is desired cross-origin resource sharing or course allows web developers to work around the same origin policy course adds HTTP headers that instruct web browsers on how to use and manage cross domain content the browser then allows or denies access to the content based on its security configuration that is if the HTTP header has no has the course content it is allowed inside the domain if not it is not allowed just like the security guard has his authentication or ID card with him and HTTP header should have a course content attached to it so if it has that the domain will allow your course request now let us move on to how does scores work when a browser executes a script that refers a resource on another domain it requires the content directly from the second domain the second domain determines whether or not to serve the content by validating the first domain which is included as part of the request that is the request coming into the second domain will already have the request of the first domain attached to it the second domain then returns either the content or an error message back to the browser by passing the first domain entirely that is after the second domain it acquires the request from the client this request will obviously have the request from the first domain attached to it and it will see if the course security is correct or not if everything looks good it will serve the request bypassing the first server or it will give you an error message or it will be blocked I showed another figure now let us take a look at the step-by-step process of how cars Works Step 1 a user opens a resource on a page that references another domain this is usually a JavaScript file but can handle web fonts and CSS resources as well and then the second step is the user's browser creates a connection to the second domain adding an origin HTTP header to the request which contains the first domain now we'll move on to the third step the second domain replies with an access control origin HTTP header which lists the domains allowed to make the course requests the wild card or also Asterix allows all domains to make requests now the fourth step if the first domain is allowed to make the request the second domain responds with the requested content so this is how cost works the access control allow origin header now let us see what this means it is defined in the second domain server configuration that is it will be present in the second domain if the header doesn't contain wildcards and the first domain isn't explicitly included the browser displays an error message that is if the course header is not present in the request of the second domain it will display an error message so the first domain and the second domain should be configured properly for it to share resources now we'll move on to an example of course usage that is where it is used in the real world we'll take one example cost is an essential feature of online storage services such as Amazon S3 so Amazon is a web service provider it is the number one web service provider in the world right now and it provides a storage service called S3 S3 is pretty popular it is store it is used to store any object objects such as images text files or video files Etc any objects can be stored in Amazon S3 service providers configure S3 to allow course requests from their website's domain when a user accesses the website and runs the script the browser makes a request to S3 since S3 is configured to allow the domain that is once you create the Amazon S3 buckets you need to configure it to be able to accept course requests and if that is done everything goes well and the request is completed and the content is delivered to the browser so Amazon S3 provides a course capabilities as well in their S3 service more complicated cross domain requests use pre-flighting to validate a request before the request is actually performed pre-flighted requests include custom HTTP headers which help the server determine whether or not a request is valid pre-flighted requests help service providers better protect sensitive information from users who might abuse the course requests now that we have seen what course is used in real life let us move to the last stopping that is the conclusion part of this video hackers are always looking for ways to undermine the security of the web to this day cross-site scripting or xss is one of the most popular ways of bypassing the same origin policy and it accounted for 84 percent of all security vulnerabilities not long ago the great thing about cores is that it gives web services the freedom to interconnect with other web services without making their users vulnerable to attacks that's it from my side guys thank you for watching have a nice day just a quick info guys intellipad provides full stack web development course in collaboration with enict IIT guwahati the course link of which is given in the description below

Channel: Intellipaat

Views: 17,857

Keywords: webdev, app development, lesson, tutorial, 100 seconds of code, cors, rest apis, cors error, fix cors, cross origin resource sharing, web, chrome browser, webdevsimplified, cross origin policy, cors js, cors javascript, cors explained, cors policy, cors header 'access-control-allow-origin' missing, how to fix cors error, cors node.js, cors node, cors nodejs, cors node js, cors security, javascript, js, node, nodejs, node js, node.js, akshaysaini.in

Id: GPI-wOTmn8k

Length: 11min 55sec (715 seconds)

Published: Sun Jul 24 2022