Why is Access-Control-Allow-Origin required for uncredentialed cross-domain requests? [duplicate]

Question

I understand CSRF and why cross-domain AJAX requests with cookies or other credentials can't be permitted without an Access-Control-Allow-Credentials header explicitly permitting them - otherwise I'd be able to do things like lure people to a site that hijacks their Facebook cookies to post something on Facebook in their name.

What I don't understand is why even uncredentialed cross-domain AJAX requests are not permitted without an Access-Control-Allow-Origin header. With no credentials involved, CSRF seems impossible and so the only arguments that I know about for the Same Origin Policy seem not to apply. What vulnerability would sites or users be exposed to if this restriction were not in place?

Answer 1

You have stumbled on a bit of a of an irregularity caused by an attempt to make secure standards. In short, CSRF exploits can't use a CORS XHR because of the preflight requst, attackers are forced to use other techniques. In an XHR, you can read the response. However in a CSRF attack, the attacker doesn't care about reading the response. A GET based CSRF exploit can just be a simple <img> tag. A POST based CSRF exploit is as follows:

<form id="csrf_exploit" action="https://victim_site/passsword_change" method="POST">
  <input name="new_password" value="hacked">
  <input name="repeat_password" value="hacked">
  <input type=submit>
</form>
<script>
  document.getElementById("csrf_exploit").submit();
</script>

In the above exploit, the entire browser is redirected when the POST request is sent. Often an exploit like this is placed within an iframe to hide this redirection from the victim. The browser renders the response, and the attacker gains the benefits from the side-effect produced by the request. In this case the side-effect is changing the users password.