2
votes
1answer
166 views

How are Ajax requests vulnerable to CSRF attacks if the Same-origin policy is applied?

What I know about CSRF is that a malicious website tricks a normal user into issuing a request to a trusted website using a form. I understand that is possible because we can post forms to different ...
3
votes
1answer
623 views

Access-Control-Allow-Origin wihout AJAX

The post at http://security.stackexchange.com/a/43456/8340 (incorrectly?) states No, as long as the CORS Access-Control-Allow-Origin is at its default restrictive value. This prevents the outer ...
1
vote
2answers
234 views

Can older or custom web browsers override the same origin policy?

I totally understand the basis of origin policy and the reasoning why all modern browsers have put this policy into place. My question I guess is, do older browsers support this, and if they don't, ...
17
votes
4answers
2k views

What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?

I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue. Since JSONP bypasses ...