0

Why do Browsers implement a Same-Origin-Policy (SOP) to prevent open websites in the browser from executing scripts that may access / modify data of other open websites in the used browser?

Another more 'usual' approach would be to simply sandbox each open website, i.e. every website 'thinks' to be the only website on the browser. This approach is in my opinion more familiar to prevent an attack of e.g. evil.com accessing data from bank.com.

Is there any advantage in using SOP with respect to sandboxing?

6
  • 2
    How exactly would "sandboxing" be different than SOP?
    – user163495
    Commented Feb 7, 2020 at 12:22
  • It kind of happens, relatively. It is one of the reasons browsers use a separate instance for each page instead of a single instance for all pages, as they used to.
    – Overmind
    Commented Feb 7, 2020 at 12:44
  • chromium.org/Home/chromium-security/site-isolation
    – paj28
    Commented Feb 7, 2020 at 12:59
  • What do you mean by "Open Website"? Commented Feb 7, 2020 at 14:59
  • sometimes you want different domains to be able to talk to each other in a limited fashion. Examples include oath signins, embedded media players, and advertising campaigns.
    – dandavis
    Commented Feb 7, 2020 at 20:10

2 Answers 2

1

The problem is that cookies are browser-wide. So if some script sends a request to a website the session cookies get sent.

If you want to sandbox the websites this would have to mean that cookies are now only for one sandbox and would require that the user explicitly selects a sandbox. Firefox actually has something similar now. It's called containers but people often use it for groups of websites.

If you don't have explicit selection you could also not store cookies but that is even more inconvenient and therefore not viable.

1

Open up the developer tools on your browser next time you visit a site - even sites not deriving their income from targeted advertising will be accessing resources on public repositories, calling analytics and doing other thngs than just accessing the site you typed in the URL.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .