Linked Questions
17 questions linked to/from Why is the same origin policy so important?
89
votes
5
answers
117k
views
CSRF protection with custom headers (and without validating token)
For a REST-api it seems that it is sufficient to check the presence of a custom header to protect against CSRF attacks, e.g. client sends
"X-Requested-By: whatever"
and the server checks the ...
- 993
22
votes
3
answers
7k
views
Why is the synchronizer token pattern preferred over the origin header check to prevent CSRF
I am well aware of the concept of CSRF, and I think I am also aware of the possible protection possibilities, as described by OWASP. However, I'm not sure why the synchronizer pattern seems to be ...
- 5,493
21
votes
3
answers
6k
views
What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?
I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue.
Since JSONP bypasses same-...
- 311
11
votes
4
answers
3k
views
Preventing insecure webapp on subdomain compromise security of main webapp
I want your help on getting more concrete information on a type of vulnerability that I remember vaguely.
I vaguely remember hearing about a year ago that if you set up a webapp on a subdomain, and ...
- 2,068
14
votes
1
answer
898
views
What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt?
I run a localhost-only webserver (PHP's built-in one) for all my admin panels and whatnot on my machine. I'm worried that, if any random webpage has a JavaScript snippet which makes an Ajax call to ...
- 149
4
votes
4
answers
3k
views
about CSRF on form submit [duplicate]
I'm surely missing something in the picture of how CSRF attacks and protections are working.
My understanding in a form-submit scenery is the protection rely on a unpredictable token, someway is ...
- 151
4
votes
1
answer
6k
views
"Same origin policy" and XSS
I understand SOP, 'Same origin policy' is supposed to prevent script code with origin x from accessing data with origin y. Origin is said to be a tuple of protocol, domain and port.
This explains ...
- 143
14
votes
4
answers
3k
views
Security implications of download attribute
The download attribute in an a element tells the browser to force the download of a file that otherwise would be interpreted by the browser. This is very convenient, since often users want to download ...
- 506
4
votes
1
answer
7k
views
In which ways could a javascript making a cross domain HEAD request be a threat?
I was just reading this answer to the question Why is the same origin policy so important?
Basically, when you try to make an XMLHttpRequest to a different
domain, the browser will do one of two ...
- 1,312
5
votes
2
answers
2k
views
Is same origin policy for web only useful because of cookies?
There is a same origin policy in the browser to ensure that e.g. bad site won't read your data from Facebook. But it seems that the only problem that it tries to solve is that cookies are ...
- 2,287
8
votes
2
answers
3k
views
Why are cookies sent with HTML page's cross domain requests but not with JS's XHR?
When we write a HTML page with form tag and an action attribute and a submit button. As soon as we click on submit a request is sent (with cookies) to the URL which was the value of action attribute.
...
- 81
3
votes
3
answers
857
views
Understanding SOP in multiple tabs
I am reading another answer on this website.
It says:
Assume you are logged into Facebook and visit a malicious website in
another browser tab. Without the same origin policy JavaScript on that
...
- 1,095
3
votes
1
answer
1k
views
Why is the same origin policy sensible - for requests?
This is not the same question as Why is the same origin policy so important?.
That one asks only about why cookies are only ever send to origin they came from, which I understand.
What I don't ...
- 149
2
votes
2
answers
442
views
Can a Content Security Policy (CSP) enable *new* unsafe behavior?
Does the design and implementation of the content security policy standard allow for the introduction of new unsafe behavior that wasn't there prior to having any CSP at all?
For example if my ...
- 123
1
vote
1
answer
644
views
Are CORS headers useless?
It is common to say that CORS headers protect against CSRF, so that if you visit a malicious website, it cannot make a request to your web application because the referer header (the URL of the ...