title: Why is CORS without credentials forbidden?
body: <p>I'm trying to understand why cross-domain requests without credentials are not allowed (by default, without setting up a server to return the <em>Access-Control-Allow-Origin</em> header). When a request has credentials all is pretty straightforward - one can fulfill some malicious actions on your behalf on other sites, for example on Facebook, if you have logged in on it. </p>
  
  <p>For example, the request</p>
  
  <pre><code>xhr = new XMLHttpRequest();
  xhr.open('GET', 'http://www.google.com');
  xhr.send();
  </code></pre>
  
  <p>produces the error (I executed it in Chrome's console from this site):</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load <a href="http://www.google.com/" rel="nofollow noreferrer">http://www.google.com/</a>. No
    'Access-Control-Allow-Origin' header is present on the requested
    resource. Origin '<a href="http://stackoverflow.com">http://stackoverflow.com</a>' is therefore not allowed
    access.</p>
  </blockquote>
  
  <p>So, the server must send an appropriate header (e.g <em>Access-Control-Allow-Origin: *</em> ) to this request can work.</p>
  
  <p>This is just a simple request and no cookies are sent. What's the reason for such a restriction? What security issues might take place if such CORS will be allowed?</p>
  
  <p><em>without credentials</em> - without cookies:
  default settings for XMLHTTPRequest is <code>withCredentials = false</code>, so no cookies are sent in the request - <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Requests_with_credentials" rel="nofollow noreferrer">link</a>. </p>