* cors.als

* A model of the cross-origin resource sharing (CORS) mechanism

* intended for cross-domain communication from a script and a server

*/

module cors

open script

open origin

sig CorsRequest in XmlHttpRequest {

-- "origin" header in request from client

origin: Origin,

-- "access-control-allow-origin" header in response from server

allowedOrigins: set Origin

}{

from in Script

}

fact corsRule {

all r: CorsRequest |

-- the origin header of a CORS request matches the script context

r.origin = origin[r.from.context.src] and

-- the specified origin is one of the allowed origins

r.origin in r.allowedOrigins

}