3

Same origin policy is to restrict one page to access another document from accessing data. Because they have different origin where SOP define an origin as follows.

An origin is defineed as protocol, host-name and port. If page or document is there then the SOP does apply to it if it matches these three.

I as wondering

Why the SOP is based on a Host-name and not on IP address ??

If SOP is based on IP address what issues we will have. Currently SOP can be attacked using DNS where rebinding Attacker wants to gain access to network behind a firewall and abuse Time-To-Live of DNS to bypass SOP.

  • Using HTTPS always is a strong mitigation to DNS abuse here. The DNS attacker would need to have the victim domain's private key too... – trognanders Jul 11 '18 at 20:07
4

It is very common to have multiple domain on the same IP address and often these domains are controlled by different parties. This is both typical for cheap hosting and for CDN like Cloudflare. Having the same origin policy based on IP address only would make cross-domain attacks possible. This would still allow using both IP address and hostname combined as restriction.

Additionally the same domain could be hosted by multiple IP addresses, for example with geo-specific IP addresses or with DNS based load balancing (i.e. round-robin DNS). Restricting the SOP to a specific IP address for the same hostname would lead to unexpected behavior, i.e. sometimes requests within the same hostname work and sometimes not. Thus, restricting the SOP additionally to the IP causes reliability problems.

This only leaves the SOP like it currently is, i.e. restricted to hostname but not IP address. Unfortunately this leaves it open to DNS rebinding attacks. But, assuming that the hacker does not control the DNS for the original hostname of a site, bypassing SOP with DNS rebinding only works if the target host does not properly check the Host header in the request, i.e. allows an attacker controlled hostname inside the request. Thus, this risk can be mitigated by properly checking the Host header at the server. It can also be mitigated by using HTTPS since the server does not have a certificate matching the attacker controlled hostname and the browser will thus refuse the connection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.