{"id":13905,"date":"2025-03-01T13:30:14","date_gmt":"2025-03-01T10:30:14","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/cors-tarayicilarin-guvenlik-duvari-ve-cozum-yollari\/"},"modified":"2025-03-01T13:30:14","modified_gmt":"2025-03-01T10:30:14","slug":"cors-tarayicilarin-guvenlik-duvari-ve-cozum-yollari","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/cors-tarayicilarin-guvenlik-duvari-ve-cozum-yollari\/","title":{"rendered":"CORS: Taray\u0131c\u0131lar\u0131n G\u00fcvenlik Duvar\u0131 ve \u00c7\u00f6z\u00fcm Yollar\u0131"},"content":{"rendered":"

<\/p>\n

CORS: Taray\u0131c\u0131lar\u0131n G\u00fcvenlik Duvar\u0131 ve \u00c7\u00f6z\u00fcm Yollar\u0131<\/p>\n

Web geli\u015ftirmede s\u0131k\u00e7a kar\u015f\u0131la\u015ft\u0131\u011f\u0131m\u0131z bir kavram olan CORS (Cross-Origin Resource Sharing) veya T\u00fcrk\u00e7e kar\u015f\u0131l\u0131\u011f\u0131yla K\u00f6kenler Aras\u0131 Kaynak Payla\u015f\u0131m\u0131, taray\u0131c\u0131lar\u0131n g\u00fcvenli\u011fini sa\u011flamak amac\u0131yla uygulad\u0131\u011f\u0131 bir g\u00fcvenlik mekanizmas\u0131d\u0131r. Basit\u00e7e a\u00e7\u0131klamak gerekirse, farkl\u0131 domainler (\u00f6rne\u011fin, www.fatihsoysal.com ve api.example.com) aras\u0131nda yap\u0131lan istekleri kontrol eder. Bu kontrol, k\u00f6t\u00fc niyetli sald\u0131r\u0131lardan korunmak i\u00e7in hayati \u00f6nem ta\u015f\u0131r.<\/p>\n

\u00d6rne\u011fin, www.fatihsoysal.com sitesinden api.example.com adresine bir AJAX iste\u011fi g\u00f6ndermek istedi\u011finizi d\u00fc\u015f\u00fcn\u00fcn. Taray\u0131c\u0131, bu iste\u011fin g\u00fcvenli olup olmad\u0131\u011f\u0131n\u0131 CORS politikalar\u0131na g\u00f6re de\u011ferlendirir. E\u011fer api.example.com sunucusu CORS politikalar\u0131n\u0131 do\u011fru \u015fekilde yap\u0131land\u0131rmam\u0131\u015fsa, taray\u0131c\u0131 iste\u011fi engeller ve bir hata mesaj\u0131 d\u00f6nd\u00fcr\u00fcr. Bu da uygulaman\u0131z\u0131n beklenmedik \u015fekilde \u00e7al\u0131\u015fmas\u0131na veya hi\u00e7 \u00e7al\u0131\u015fmamas\u0131na neden olabilir.<\/p>\n

CORS Nas\u0131l \u00c7al\u0131\u015f\u0131r?<\/h2>\n

CORS mekanizmas\u0131, istek g\u00f6nderen ve istek alan sunucular aras\u0131nda bir ileti\u015fim protokol\u00fc kullan\u0131r. \u0130lk olarak, istek g\u00f6nderen taray\u0131c\u0131, istek alan sunucuya bir \u00f6n-istek (preflight request) g\u00f6nderir. Bu \u00f6n-istek, OPTIONS metodu ile yap\u0131l\u0131r ve sunucunun belirli bir istek t\u00fcr\u00fcn\u00fc kabul edip etmedi\u011fini sorar. \u00d6rne\u011fin, Content-Type ba\u015fl\u0131\u011f\u0131nda application\/json kullan\u0131l\u0131p kullan\u0131lamayaca\u011f\u0131n\u0131 kontrol eder. <\/p>\n

Ard\u0131ndan, sunucu bu \u00f6n-iste\u011fe yan\u0131t olarak, Access-Control-Allow-Origin gibi CORS ba\u015fl\u0131klar\u0131n\u0131 i\u00e7eren bir yan\u0131t g\u00f6nderir. Bu ba\u015fl\u0131klar, hangi kaynaklar\u0131n (domainler) istekte bulunabilece\u011fini belirtir. E\u011fer sunucu bu ba\u015fl\u0131klar\u0131 do\u011fru \u015fekilde ayarlam\u0131\u015fsa ve istek CORS politikalar\u0131na uygunsa, taray\u0131c\u0131 iste\u011fi tamamlar. Aksi takdirde, istek engellenir. <\/p>\n

CORS Hatalar\u0131 ve \u00c7\u00f6z\u00fcmleri<\/h2>\n

CORS hatalar\u0131, genellikle sunucu taraf\u0131nda yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f CORS ba\u015fl\u0131klar\u0131ndan kaynaklan\u0131r. Bununla birlikte, istemci taraf\u0131nda da baz\u0131 hatalar g\u00f6r\u00fclebilir. En s\u0131k kar\u015f\u0131la\u015f\u0131lan hata mesaj\u0131, “Access to XMLHttpRequest at ‘…’ from origin ‘…’ has been blocked by CORS policy” \u015feklindedir. Bu hata, taray\u0131c\u0131n\u0131n iste\u011fi engelledi\u011fini g\u00f6sterir. <\/p>\n

Bu hatan\u0131n \u00e7\u00f6z\u00fcm\u00fc, genellikle sunucu taraf\u0131nda Access-Control-Allow-Origin ba\u015fl\u0131\u011f\u0131n\u0131n do\u011fru \u015fekilde ayarlanmas\u0131d\u0131r. \u00d6rne\u011fin, www.fatihsoysal.com sitesinden gelen istekleri kabul etmek i\u00e7in Access-Control-Allow-Origin: https:\/\/www.fatihsoysal.com ba\u015fl\u0131\u011f\u0131 kullan\u0131lmal\u0131d\u0131r. Ancak, Access-Control-Allow-Origin: * ba\u015fl\u0131\u011f\u0131 t\u00fcm kaynaklar\u0131 kabul etti\u011fi i\u00e7in g\u00fcvenlik a\u00e7\u0131s\u0131ndan risklidir ve m\u00fcmk\u00fcn oldu\u011funca kullan\u0131lmamal\u0131d\u0131r. Bunun yerine, spesifik domainleri belirtmek daha g\u00fcvenli bir yakla\u015f\u0131m olacakt\u0131r. <\/p>\n

Ayr\u0131ca, Access-Control-Allow-Methods, Access-Control-Allow-Headers gibi di\u011fer CORS ba\u015fl\u0131klar\u0131n\u0131 da do\u011fru \u015fekilde yap\u0131land\u0131rmak \u00f6nemlidir. Bu ba\u015fl\u0131klar, izin verilen HTTP metodlar\u0131n\u0131 ve ba\u015fl\u0131klar\u0131n\u0131 tan\u0131mlar. <\/p>\n

\u00d6zetle<\/h2>\n

CORS, web geli\u015ftirmede g\u00fcvenli\u011fi sa\u011flamak i\u00e7in \u00f6nemli bir mekanizmad\u0131r. Do\u011fru \u015fekilde uygulanmad\u0131\u011f\u0131 takdirde, istenmeyen hatalara ve g\u00fcvenlik a\u00e7\u0131klar\u0131na yol a\u00e7abilir. Ancak, CORS ba\u015fl\u0131klar\u0131n\u0131 do\u011fru \u015fekilde yap\u0131land\u0131rarak, farkl\u0131 domainler aras\u0131nda g\u00fcvenli bir \u015fekilde veri al\u0131\u015fveri\u015fi yapmak m\u00fcmk\u00fcnd\u00fcr. Bu makalede anlatt\u0131\u011f\u0131m bilgiler, CORS konusunda daha fazla bilgi edinmenize yard\u0131mc\u0131 olacakt\u0131r. Daha detayl\u0131 bilgi i\u00e7in fatihsoysal.com<\/a> sitesini ziyaret edebilirsiniz.<\/p>\n

Bu konuda daha fazla bilgi edinmek isteyenler i\u00e7in a\u015fa\u011f\u0131daki kaynaklara da bakabilirsiniz:<\/p>\n