0

Why do Browsers implement a Same-Origin-Policy (SOP) to prevent open websites in the browser from executing scripts that may access / modify data of other open websites in the used browser?

Another more 'usual' approach would be to simply sandbox each open website, i.e. every website 'thinks' to be the only website on the browser. This approach is in my opinion more familiar to prevent an attack of e.g. evil.com accessing data from bank.com.

Is there any advantage in using SOP with respect to sandboxing?

6
  • 2
    How exactly would "sandboxing" be different than SOP? – MechMK1 Feb 7 '20 at 12:22
  • It kind of happens, relatively. It is one of the reasons browsers use a separate instance for each page instead of a single instance for all pages, as they used to. – Overmind Feb 7 '20 at 12:44
  • What do you mean by "Open Website"? – Conor Mancone Feb 7 '20 at 14:59
  • sometimes you want different domains to be able to talk to each other in a limited fashion. Examples include oath signins, embedded media players, and advertising campaigns. – dandavis Feb 7 '20 at 20:10
1

The problem is that cookies are browser-wide. So if some script sends a request to a website the session cookies get sent.

If you want to sandbox the websites this would have to mean that cookies are now only for one sandbox and would require that the user explicitly selects a sandbox. Firefox actually has something similar now. It's called containers but people often use it for groups of websites.

If you don't have explicit selection you could also not store cookies but that is even more inconvenient and therefore not viable.

1

Open up the developer tools on your browser next time you visit a site - even sites not deriving their income from targeted advertising will be accessing resources on public repositories, calling analytics and doing other thngs than just accessing the site you typed in the URL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.