Tag Info

New answers tagged

3

But in what scenarios is this really used ? Everywhere. Otherwise if you visited my website example.com I would be able to read your Gmail if you were logged in at the time from the same browser. the scripts won't be subject to SOP as they belong to my website's origin. Correct: They won't be subject to any restrictions by the SOP. If they try ...


0

I'm not able to understand how can the malicious domain access facebook account from a different tab and how does SOP protect against this? Tabs are not isolating entities. That is, cookies are shared between every window a browser has open, including all tabs on those windows. The only exception to this are private/incognito windows. Therefore, if a ...


0

The malicious domain cannot access the facebook account from a different tab because SOP prevents scripts, which the browser knows came from evil.com, from accessing properties and methods of scripts coming from victim.com . The problem is that since HTTP is stateless, if a script from evil.com running on your browser were to issue a request to a service on ...


0

Because of the way CSRF protection is implemented (e.g. as a hidden form value that is set by the server) if an evil origin can read responses your browser receives from facebook.com it would be able to submit a form to facebook with the correct CSRF token, thus bypassing any of facebook's CSRF protection. Since the same origin policy prevents other domains ...


0

TL:DR Same Origin Policy mainly prevents retrieval of information, not sending. Same Origin Policy stops malicious.com from using cookies for bank.com to retrieve sensitive information from bank.com. The key thing to note is that the Same Origin Policy tries to prevent a script from malicious.com from every seeing any data from bank.com. Once a script from ...


4

Can A.js call a function from B.js? No, the javascript need to be defined on your current page Can A.js modify the DOM of page B.html? Yes, but you need a reference AND have the same origin. If page A have a reference to page B, it is possible for A to modify the DOM in B. Page A can have a reference to page B if page A opened page B and saved ...



Top 50 recent answers are included