The same-origin-policy is one of several models that web browsers use to determine which JavaScript files in a webpage should be executed. This is determined by the domain (the origin).

learn more… | top users | synonyms

33
votes
2answers
60k views

Why is the Access-Control-Allow-Origin header necessary?

I understand the purpose of the Access-Control-Allow-Credentials header, but can't see what problem the Access-Control-Allow-Origin header solves. More precisely, it's easy to see how, if cross-...
3
votes
1answer
1k views

Access-Control-Allow-Origin wihout AJAX

This answer (incorrectly?) states No, as long as the CORS Access-Control-Allow-Origin is at its default restrictive value. This prevents the outer website from accessing the framed website via ...
8
votes
1answer
848 views

Child iFrame hash verification of parent iFrame content

Consider the following scenario: Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not ...
5
votes
1answer
1k views

Does returning Access-Control-Allow-Origin: * weaken the security of JSON GET responses?

The W3C CORS recommendation states: Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins. ... 3. A GET ...
3
votes
2answers
81 views

Does displaying images on profiles by URL have security implications?

I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic ...
12
votes
1answer
984 views

How can I embed iframe securely without restricting its functionality?

I'd want to embed an iframe from untrusted site into web application. Iframe: should be able to run Javascript and browser plugins (Flash, etc.) should not be able to access my web application ...
1
vote
3answers
155 views

Understanding SOP in multiple tabs

I am reading another answer on this website. It says: Assume you are logged into Facebook and visit a malicious website in another browser tab. Without the same origin policy JavaScript on that ...
72
votes
4answers
27k views

Why is the same origin policy so important?

I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
5
votes
1answer
885 views

Why CSRF's JS can't read token by GETting html

1) User is logged in bank.com in one tab, where everything is secured by CSRF tokens. Then he opens evil.com in another tab. 2) Javascript in evil.com might try to make a POST request to bank.com/...
3
votes
3answers
166 views

What purpose does Access-Control-Allow-Origin have?

I have a misunderstanding regarding CORS' Access-Control-Allow-Origin header. It's name says "allow" from which I understand that if I make a request from an "Origin" that is not allowed the request ...
3
votes
1answer
57 views

How does the same-origin-policy protect against PUT/DELETE CSRF?

I've read the OWASP guide for cross-site request forgery and it states that "other HTTP methods", such as PUT and DELETE could be theoretically used for CSRF. However with the same-origin-policy ...
3
votes
1answer
76 views

Is same origin policy for web only useful because of cookies?

There is a same origin policy in the browser to ensure that e.g. bad site won't read your data from Facebook. But it seems that the only problem that it tries to solve is that cookies are ...
6
votes
1answer
278 views

Alternative to anti-CSRF tokens for AJAX request (Same Origin Policy)

I'm working on a PHP website based entirely on AJAX (via jQuery). It's a single page in which all requests are made by AJAX. Related to the protection against CSRF I have encountered the problem of ...
0
votes
1answer
67 views

WebCrypto, SOP and Yubikeys

I've been following some discussions on WebApp Security mailing list regarding WebCrypto and SOP policies (100+ messages). One of the things that kind of sprang out was keys held in WebCrypto were not ...
1
vote
2answers
3k views

Implications of the security model of HTTP cookies on HTTPS connections

I have a feature that would require the user being able to provide the URL for a custom script, store the URL in a cookie, and incorporate the script into subsequent responses. This, of course, ...
1
vote
1answer
120 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
6
votes
3answers
376 views

Same Origin Policy - XHR response

I know that Same Origin Policy (SOP) prevents a page/script from one origin to read response from another origin, but it does not prevents the page/script from making a XMLHttpRequest (XHR) request to ...
2
votes
4answers
426 views

about CSRF on form submit [duplicate]

I'm surely missing something in the picture of how CSRF attacks and protections are working. My understanding in a form-submit scenery is the protection rely on a unpredictable token, someway is ...
2
votes
0answers
115 views

Is there an iframe attack surface to webcache.googleusercontent.com?

I've noticed that one of my web-sites shows up pretty much blank when viewed from Google Cache at webcache.googleusercontent.com, because Google apparently must be inserting the following extra header,...
46
votes
2answers
38k views

Why do browsers enforce the same-origin security policy on iframes?

I did a small test on Chrome (V37) today. I created a small page and loaded it to the browser: <!DOCTYPE html> <html> <head> <title>Untitled Document</title> </...
4
votes
1answer
85 views

Practical implications of 2014's android SOP vulnerability

For a project at university I have done research about all kinds of security issues, especially privacy-related ones, that have come up on mobile OS and applications over the last few years. One of ...
17
votes
3answers
3k views

What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?

I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue. Since JSONP bypasses same-...
2
votes
2answers
200 views

Can postMessage be used to forward data to hacker's iframe in CSRF attack?

Consider a user that has an open session to a legitimate site with a password on it. This page has no anti-CSRF token. A hacker creates a webpage with 2 hidden iframes. One iframe does a GET on the ...
3
votes
3answers
904 views

Flash ignores Content-Type header, allowing XSS?

I recently read that the Flash plugin ignores the Content-Type header in certain circumstances. In particular, you can give Flash a URL, and the Flash plugin will happily fetch the content at that ...
2
votes
1answer
218 views

Uses of same origin policy

I am trying to understand what use cases exist for the use of Same Origin Policy (SOP). SOP prevents a document or script loaded from one origin to interact with a resource from another origin. But ...
3
votes
1answer
440 views

How does the same-origin policy apply between browser tabs? [duplicate]

Let's assume that we have 2 open tabs in a browser containing page A (A.html, A.js) into the first tab and page B (B.html, B.js) into the second tab and that page A and B have the same origin (scheme, ...
5
votes
1answer
590 views

Why is a child window allowed to change the location of its parent?

Maybe a silly question. When opening a new tab via target="_blank", the page that loads in that tab is allowed to set a new location in the parent tab using: window.opener.location.replace('http://...
6
votes
3answers
5k views

Why doesn't the same origin policy block get requests that contain arguments?

From what I understand, the same origin policy prevents scripts in a web page from talking to servers outside of the present domain (using post, xmlhttprequest, etc). I assumed that get requests (...
3
votes
3answers
954 views

How is the same origin policy causing my PoC to fail when I don't need to read return data?

I'm performing an authorized vulnerability analysis on a custom web service and have discovered a CSRF vulnerability. Due to there not being form tokens coupled with the service not checking for the ...
8
votes
4answers
287 views

Same-origin policy for desktop application?

The same-origin policy is one of the most important security feature in our browser. It basically provides sandboxing for our applications which is protecting our users. Desktop application can read ...
1
vote
1answer
648 views

Understanding Same origin policy

I am trying to understand same origin policy better. From what I understand same origin policy restricts code from one "origin" not access data from another "origin". What I am trying to understand is ...
1
vote
1answer
832 views

CSRF Token Stealing

I came across this link that dicusses how an attacker could exploit access control allow origin to get an anti-CSRF token: http://yossi-yakubov.blogspot.com/2011/09/bypassing-token-protection-against-...
7
votes
1answer
2k views

How are Ajax requests vulnerable to CSRF attacks if the Same-origin policy is applied?

What I know about CSRF is that a malicious website tricks a normal user into issuing a request to a trusted website using a form. I understand that is possible because we can post forms to different ...
1
vote
1answer
948 views

SSO via HMAC and shared key. Can this be improved?

Given an authenticated user on A.com, we want to redirect the user to B.com so that she'll be immedaitely authenticated. The scheme I'm considering is very basic: A.com and B.com both share key S. ...
2
votes
1answer
514 views

In Same Origin Policy, why are different protocols considered a security violation?

I can understand why content from different domains is considered to be unstrusted for the same origin policy. But, how can be content from diferent protocols from the same site/domain be dangerous? ...
1
vote
2answers
515 views

Can older or custom web browsers override the same origin policy?

I totally understand the basis of origin policy and the reasoning why all modern browsers have put this policy into place. My question I guess is, do older browsers support this, and if they don't, ...
1
vote
1answer
1k views

ReverseProxy and PCI Compliance

My company has a PCI compliant billing gateway and they expose a service for submitting credit card payment details. I am writing a (Single Page Application/end-to-end javascript) website for them ...
3
votes
2answers
157 views

Securely render SVG

How can I securely render SVG documents in a media sharing application? I think the same-origin policy might help a bit if I host the SVG documents on a separate domain and render them inside an <...
1
vote
1answer
81 views

Gaining sensible information from advertisement displayed in web pages

As we all know, JavaScript loaded inside a website A gets restricted to access the domain itself [same origin policy]. Unfortunately, same origin policy does not apply to newly created DOM nodes, ...
2
votes
1answer
745 views

Why is Access-Control-Allow-Origin required for uncredentialed cross-domain requests? [duplicate]

I understand CSRF and why cross-domain AJAX requests with cookies or other credentials can't be permitted without an Access-Control-Allow-Credentials header explicitly permitting them - otherwise I'd ...
2
votes
4answers
243 views

New gTLDs are coming. How will browsers handle cookies, SOP and certificates?

Given that the security "zone" varies based on the TLD, how will the new TLS be handled? For example: A browser may permit cookies to be shared and SSL certificates, and wildcard certificates ...
2
votes
1answer
4k views

In which ways could a javascript making a cross domain HEAD request be a threat?

I was just reading this answer to the question Why is the same origin policy so important? Basically, when you try to make an XMLHttpRequest to a different domain, the browser will do one of two ...
3
votes
1answer
283 views

What servers or clients are immune to related-domain cookie attacks? (*.example.com)

In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com). Lacking any tangible solution, ...
8
votes
2answers
860 views

Best practices for integrating external javascript?

I'm looking for some standard pieces of advice on how to integrate external JavaScript into a website. For example, on mywebsite.com: <script src='//externalsite.com/js/script.js'></script&...
0
votes
1answer
203 views

How does DOCTYPE selection affect security of my AJAX app?

I'm considering using modern techniques to protect my Javascript code and am studying how the DOCTYPE element selection may impact that. Specifically, the linked question used IFrames which are not ...
1
vote
1answer
1k views

What is the “about:blank” context for browser security and privacy?

This blog is describing a way to hide the referer header in various situations. Specifically he is referring to things that run in the about:blank context. What is the about:blank context? How does ...
1
vote
2answers
222 views

How do browsers know which cookie to get?

I tried writing a script that would display the contents of a cookie set by another website but it didn't work. <?php echo 'Website cookie is '.$_COOKIE['locale']; ?> But I get an undefined ...
4
votes
2answers
272 views

Defense against same origin attacks?

The Question: How do I, as the victim, protect my site from being manipulated into doing something it's not supposed to, on a shared host? Same-Origin policy looks the other way. Most convenient ...
6
votes
1answer
2k views

Same-origin policy for file: URLs in Android browser?

When you load a file:// URL in an Android WebView or in the Android browser, what does it treat as the origin? What can the Javascript on that page access? Can it access other files in the same ...
9
votes
2answers
871 views

User-specific Subdomains : JavaScript security

If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...