beefproject/beef — Issue #352: Dynamic Handler doesn't add Access-Control-Allow-Origin
Author: passbe
Created: 2011-12-10 22:53:08+00:00
State: open

The new DH is not adding needed response headers like

Access-Control-Allow-Origin'] = '*'

and

Access-Control-Allow-Methods = 'POST, GET'

They must be added, otherwise in real-life BeEF usage browsers will not be hooked at all, and errors like the following will be thrown:

XMLHttpRequest cannot load http://10.211.55.2:3000/dh?bh=BE1ho0bubIiVJLe1fT9LvDq2D4bK6ZAvrbnTvEvcx5KgZe6Pt4GQRIkCypwlmP9rvngLe9PFtZQsTxDi&sid=1&pid=1&pc=1&d=Ilt7XCJjaWRcIjogMCwgXCJyZXN1bHRzXCI6IFtdLCBcImhhbmRsZXJcIjogXCIvaW5pdFwifV0i. Origin https://centosplesklast:8443 is not allowed by Access-Control-Allow-Origin
Google Code Issue: http://code.google.com/p/beef/issues/detail?id=328