1650844 - CORS without Allow-Origin still shows response in network inspector

Status: RESOLVED WONTFIX

(DevTools :: Netmonitor, defect)

Description

[Kaushal Patel]

Attachment: Mozilla.docx

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36

Steps to reproduce:

1. I made cors poc for one website. which website don't configure with "Access-Control-Allow-Origin".
2. I didn't get response on web. But i get response in inspect.

Actual results:

Browser block my request due to CORS missing allow origin. But it show response data in inspect.

Expected results:

If properly CORS missing allow origin set then I am not able to see response data in inspect too.

Version 78.0.1

Comment 1

[:Gijs (out for now; he/him)]

There's no way to not make the request - it's a GET request, the spec does not require an OPTIONS request first, and so the only way to see if the request will happen is to actually make it and then evaluate the response headers.

Whether the response is displayed in devtools isn't a security issue - if an "attacker" has access to devtools we have worse problems.

Whether it's confusing is something else. Perhaps we should display an overlay of sorts, indicating the response is not available to the page, with a button to 'show anyway' or whatever.

Comment 2

[:Harald Kirschner :digitarald]

Agreed, this is just for inspection and we correctly show that the request was blocked. As Gijs said, GET CORS blocking happens on responses.

If we can better annotate the response as "not available to scripts", we can open another bug for that.

Comment 3

[Kaushal Patel]

I don't see response in devtools in other browser like Microsoft EDGE and google chrome. So i reported bug.

Comment 4

[Jan Honza Odvarko [:Honza] (always need-info? me)]

(In reply to :Harald Kirschner :digitarald from comment #2)

If we can better annotate the response as "not available to scripts", we can open another bug for that.

I filed a follow up for this Bug 1651006 - Indicate that a response is not available to scripts

Honza

Comment 5

[Kaushal Patel]

OK Thank you