I am trying to understand what does SOP mean? If there are two sites such as example1.com and examole2.com what are the dangers can one of them cause to the other? Like stealing what, received what?! So SOP exists to prevent that catastrophe to happen. Thanks in advance


In a nutshell, SOP prevents code running on origin A from accessing the contents of origin B. A few specific examples:

  • By default, a script running on a.com can't read the contents of b.com (it can send the request but won't be able to read the response).
  • A script running on a.com can only access storage (cookies, local and session storage, etc.) for a.com, not for any other sites.
  • If you have a page on a.com that contains an iframe with content from b.com, a script on the parent page (a.com) can't read the content, access most events, or even determine the current URL of the iframe hosting a b.com page.
  • The reverse of the previous point: a page in an iframe (or frame, or pop-up, or object, etc.) can't read/modify/otherwise interact with the parent page if it's on a different origin (although as with the parent accessing the child, forcing the parent page to navigate is by default possible).
  • By default, "complex" types of requests (with custom headers, or any but a few content types or methods, etc.) can't be sent across origins

Without SOP, it wouldn't be safe to be signed into a website and then load content from any other site. Say you're signed into Facebook (don't necessarily have a FB tab open, but you have your FB cookie), and you browse to some news site.

  1. An ad (itself coming from a third origin) on the news site injects a script which tells your browser to make a bunch of requests to Facebook, thereby accessing your entire profile (with SOP, these requests would result in errors; the script wouldn't even know if you're signed in or not).
  2. The malicious script could then take arbitrary actions as you, so it can post stuff as you or replace everything on your profile or whatever (with SOP, it wouldn't be able to bypass the anti-CSRF protection that prevents making most cross-origin requests to Facebook, but without SOP it can see everything that the scripts on Facebook.com can see).
  3. Suppose you then open a new tab and log into your bank. Although the bank's session is short-lived, for its duration the malicious script would be able to see everything you can see on the bank site, and also take any action you could take.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.