Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [same-origin-policy]

The same-origin-policy is one of several models that web browsers use to determine which JavaScript files in a webpage should be executed. This is determined by the domain (the origin).

Filter by
Sorted by
Tagged with
1 vote
1 answer
164 views

SOP (Same Origin Policy) and CDN SVG XSS

If an SVG file with an XSS payload is hosted on say cdn.example.com and is loaded as a display picture on say mainprod.com, can the XSS payload within the SVG file access and steal cookies from ...
anonmer's user avatar
  • 13
1 vote
1 answer
365 views

Is prohibiting cookies a viable CORS alternative?

I have been using lots of various APIs in my frontend lately and they all have to be properly configured with CORS and the browser always do extra OPTIONS request that only make debugging harder. I ...
Ilya Chernomordik's user avatar
0 votes
1 answer
102 views

Why does the DOM single-origin policy take into account protocol and port? What if it was just domain?

I'm learning the basics of network security and am trying to really understand the single origin policy. I was wondering what the vulnerabilities would be if an origin was only defined by domain, as ...
hyperrealisticcarrot's user avatar
2 votes
3 answers
346 views

Why don't browsers' same-origin policies allow anonymous cross-origin requests?

Generally I've read the motivation for browser same-origin policies is to prevent data being obtained by an attacker because of the sending of credentials in a cross-origin request, and that if you're ...
Jez's user avatar
  • 314
2 votes
0 answers
97 views

Auth Token not included in CORS exploit [closed]

I have found a CORS on a website but when I am trying to exploit it for a POC it is fetching all the cookies except auth cookies and due to that I am getting an error message to "User not logged ...
Abhinav Kumar's user avatar
3 votes
1 answer
326 views

What does COEP do that CSP doesn't already do?

Both Cross-Origin-Embedder-Policy and Content-Security-Policy seem to do pretty similar things: they restrict the document from loading certain types of subresources (e.g. cross-origin subresources). ...
Flying Penguin's user avatar
1 vote
2 answers
987 views

Is my understanding of CSRF, SOP and CORS correct (Express / React)?

I am a hobby developer and am developing an application with a Node JS / Express backend and a React frontend. I am currently learning about Cross Site Request Forgery (CSRF), and I want to make sure ...
David's user avatar
  • 11
3 votes
2 answers
3k views

If browser cookies aren't shared between different websites, then why is Same origin Policy useful?

I'm a beginner to Web security and I recently started reading about Same Origin Policy and it's usefulness in preventing a malicious website from interacting with a secure website being used by a user....
Curious's user avatar
  • 31
0 votes
1 answer
641 views

Why is Content Security Policy necessary given Same Origin Policy?

Given that Same Origin Policy prevents JavaScript from one origin from running in another origin and accessing another origin's cookies, why is CSP necessary? Is it that CORS selectively removes some ...
Prime's user avatar
  • 514
0 votes
1 answer
909 views

COOP and COEP: Is there an advantage to enabling COOP / COEP if I don't need to use the sharedArrayBuffer or other features?

COOP: cross origin opener policy COEP: Cross origin embedder policy Most of the articles on the web, related to COOP / COEP, point to the fact that by enabling COOP / COEP , your web page can use the ...
gaurav5430's user avatar
2 votes
3 answers
1k views

Does SOP prevent a class of CSRF attacks?

Just want to settle a debate I'm having with someone. Suppose there is no SOP. Via an XSS exploit, code can run on website A.com and submit an XHR request to B.com. Suppose B.com stores an auth token ...
Jamal's user avatar
  • 31
0 votes
1 answer
266 views

Is the "same-origin" implied when using "frame-ancestor" in the CSP header?

If my Content-Security-Policy is set to the following: Content-Security-Policy: frame-ancestors 'self' Does it also imply: Content-Security-Policy: default-src 'self' Or is it a lot safer to put ...
Alexis Wilke's user avatar
  • 1,017
0 votes
1 answer
572 views

Securing a Websocket Connection in case of XSS Vulnerability

Goal Authenticate the Client via HTTP Request. Authenticate the Client's WebSocket connection. Prevent exploitation of WebSocket connection(when a XSS Vulnerability is present on website). How I'm ...
litz's user avatar
  • 3
2 votes
1 answer
294 views

Would "same-origin cookies" make sense?

I have read Incrementally Better Cookies, a couple of web.dev articles and tried to google for "same-origin cookies" but could not find anything so I wonder if this is being worked on. ...
Borek Bernard's user avatar
0 votes
1 answer
175 views

How do applications which are integrated using a javascript client side sdk, secure their data or disallow spam?

Take an example of google maps. google maps provides a javascript client SDK, which means any web app running javascript can access the google maps sdk. You need to use an API_KEY so that google can ...
gaurav5430's user avatar
0 votes
2 answers
394 views

Is there an issue if application responds with access control allow origin * but there is no allow credentials header?

Since application is not responding with allow credentials header, an attacker can't craft cross domain request with cookies, but I was wondering if allow origin * alone (Without credentials being ...
Jack's user avatar
  • 1
3 votes
0 answers
301 views

Cross-Origin-Opener-Policy: unsafe-none

A new HTTP header named Cross-Origin-Opener-Policy has three values: unsafe-none same-origin-allow-popups same-origin Google's web.dev article about this header explains its effects on other sites (...
rink.attendant.6's user avatar
1 vote
1 answer
188 views

Can the Origin header have alphabetical port or parameters in a real-life scenario?

I'm testing this application which is properly validating origin header on the sever side. However, if I add any domain and the expect domain as port, application still consider this valid. Origin: ...
Jack's user avatar
  • 11
28 votes
7 answers
15k views

How do hackers trick frontend validation?

I've always read: Put validations in the backend. Frontend validations are for UX, not security. This is because bad actors can trick frontend validation. But I'm having a hard time wrapping my head ...
Dashiell Rose Bark-Huss's user avatar
0 votes
0 answers
43 views

A potentially simpler same origin policy? [duplicate]

I know there are lots of posts on the same origin policy, but I specifically want to understand why it can't be done in this simpler way. If evil.com makes sends a request to bank.com, browsers will ...
curiousgeorge's user avatar
6 votes
5 answers
6k views

Why doesn't a simple HTTP request to display a remote web page violate the same-origin policy?

On a W3Schools page, I found that HTTP requests work like this: A client (a browser) sends an HTTP request to the web A web server receives the request, and runs an application to process it The ...
K. Gabor's user avatar
1 vote
0 answers
512 views

What is meaning of setting port number to NULL in document.domain call?

Here (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it is mentioned The port number is checked separately by the browser. Any call to document.domain, including document....
positron's user avatar
  • 165
3 votes
2 answers
166 views

Serving "less trusted" content on the same domain

Let's say we run a web app at "example.org". It uses cookies for user authentication. Our website also has a blog at "example.org/blog", hosted by a third party. Our load ...
Kannan Goundan's user avatar
1 vote
0 answers
128 views

Allowing 3rd-party cookies in major 2020 browsers [closed]

I'm trying to get 3rd party cookies to work on major mid-year 2020 browsers [1]. It's as simple as pointing an iframe to an external URL to make a cookied request and probably get the response ...
Pacerier's user avatar
  • 3,313
1 vote
2 answers
1k views

Why WebSockets doesn't apply SOP?

I can't understand why SOP (same-origin policy) cannot block Cross-Origin WebSocket Hijacking, I just read this article and I can't understand from where WebSocket requests comes from. From where does ...
user avatar
6 votes
2 answers
6k views

What is the connection between CORS and SameSite cookie attribute?

For most of them may be its a silly question but I want it to know this in very simple language. If an application is not using CORS at all then should we put this SameSite cookie attribute? and if ...
ZeroNullByte's user avatar
0 votes
1 answer
2k views

How to bypass origin based csrf protection?

I'm trying to do some csrf attack test on a site. I found that the site protect itself from csrf by checking the http Origin header. But I guess maybe under some conditions I can bypass the ...
apex's user avatar
  • 11
2 votes
1 answer
905 views

Ideas for subdomains isolation

Consider a blogging platform - example.com and we want to host untrusted content in subdomain1.example.com and subdomain2.example.com. By default, same origin policy doesn't allow communication ...
user2688214's user avatar
1 vote
2 answers
547 views

With the existence of CORS, what further purpose does same origin policy serve?

I've been using CORS for a while and I think I understand it. But as far as I can tell, because the allow-origin header is provided by the server being called, which an attacker can control as they ...
speciesUnknown's user avatar
3 votes
1 answer
3k views

Doesn't Samesite cookie and Sameorigin policy effectively does the same job?

Pardon me if I am wrong, however, I am looking for an answer for my understanding that isn't the concerns regarding CSRF solved by both Samesite cookie and Same-Origin-Policy effectively? Then why is ...
Jiger Jain's user avatar
0 votes
0 answers
43 views

DOM access between same-origin tabs [duplicate]

Consider the following website. Page A (https://example.com/login) contains a login form and its password field has the attributes name and id set to "password". Page B (https://example.com/vuln) has ...
Ronquam's user avatar
0 votes
2 answers
313 views

Why not sandbox websites instead of using Same-Origin-Policy?

Why do Browsers implement a Same-Origin-Policy (SOP) to prevent open websites in the browser from executing scripts that may access / modify data of other open websites in the used browser? Another ...
NightRain23's user avatar
4 votes
1 answer
6k views

"Same origin policy" and XSS

I understand SOP, 'Same origin policy' is supposed to prevent script code with origin x from accessing data with origin y. Origin is said to be a tuple of protocol, domain and port. This explains ...
monolith's user avatar
  • 143
6 votes
1 answer
369 views

Why was the Same-origin policy originally introduced (before XMLHttpRequest)?

As I understand it, the Same-origin policy (SOP) basically prevents a script in a web page from obtaining or sending information from/to a different domain. I understand that this is important to ...
sleske's user avatar
  • 1,634
1 vote
0 answers
439 views

Do best practices eliminate the need for a CSRF token when writing an API server?

I realize that OWASP recommends CSRF tokens but I rarely see them used with public standalone HTTP APIs. This would seem to indicate that they're not always necessary. To make this a little more ...
Alan Plum's user avatar
  • 111
1 vote
1 answer
869 views

Same origin policy for CSRF attack?

Per mine understanding, by default same origin policy(SOP) is enabled by default by all browsers. This means that a web browser permits scripts contained in a first web page to access data in a ...
user3198603's user avatar
44 votes
7 answers
6k views

Will the same JavaScript fetched by HTTP and HTTPS be cached separately by the browser?

Say that a web server supports both HTTP and HTTPS. If a browser fetches the same JavaScript with a HTTP GET and a HTTPS GET, and the JavaScript is cache-able, will the browser cache two copies of the ...
SamTest's user avatar
  • 715
1 vote
2 answers
10k views

Why is it not possible to spoof referer and origin header with XHR?

Technically speaking, it is possible to spoof both headers using an intercepting proxy but that's useless because we are doing it ourselves as an attacker. When we send an ajax request using JS from ...
user12507230's user avatar
0 votes
1 answer
175 views

Remote extraction of passwords from browser password managers

I'm writing an essay about "Browser Password Managers". As part of this I have to write about vulnerabilities and exploits. I stumbled across the following scientific paper from 2013: "Password ...
Toni's user avatar
  • 1
0 votes
2 answers
280 views

Can JavaScript from different origins communicate securely

I want to know if there is a way for JS from one Origin to delegate a task to JS from another origin in a secure way. The use case is to have a JS Agent from the users' home origin use the ...
bblfish's user avatar
  • 455
1 vote
1 answer
493 views

Who can access the X-CSRF token?

I'm really confused about a CSRF token implementation in a Spring web app that I've inherited. Basically, everyone can request the token by looking at what Spring Security filters do: http ...
phantasos's user avatar
1 vote
1 answer
538 views

Difficulty understanding SOP and CSRF

As said here, a CSRF attack has little to do with SOP. However, on the OWASP CSRF page it is said that Fortunately, this request will not be executed by modern web browsers thanks to same-origin ...
Sumanto Dinar's user avatar
5 votes
1 answer
1k views

Why are web font resource requests not no-cors?

CSS, JS, images etc are all fetched as no-cors. What's different about web fonts? Per the spec: For font loads, user agents must use the potentially CORS-enabled fetch method defined by the [FETCH]...
Adam Williams's user avatar
1 vote
2 answers
427 views

Are subdomains secure from one another if they are on separate servers?

I'm writing an application (example.com) that gives users their own sub-domains to run arbitrary user applications off of (user.example.com). Each user application will be run on separate servers ...
sahil's user avatar
  • 111
1 vote
1 answer
244 views

How can the Same Origin Policy protect the user in times of CORS headers?

How can the Same origin policy protect something if you can bypass it via Cross Origin Resource Sharing headers? And why are those assigned by the server which is tried to access and not by the user? ...
Hakim's user avatar
  • 113
0 votes
2 answers
3k views

CORS Anywhere to bypass CSRF protection

CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers. Can CORS Anywhere be used to bypass CSRF protection? Reason to ask ...
user11177344's user avatar
0 votes
1 answer
843 views

DNS Spoofing Detection with JavaScript

I've came across an interesting question today - how can a JavaScript detect that a DNS Spoofing attack has been made against the client its running upon? Scenario: Edit: wrong scenario was ...
albeck's user avatar
  • 101
0 votes
1 answer
127 views

Custom JavaScript injection allowed in DOM of other origins [closed]

I am performing a security research on a development framework for thick client & mobile applications. The framework allows developers to inject custom JavaScript in the DOM of any origin. This ...
Aditya Chaudhary's user avatar
2 votes
3 answers
2k views

How can the Cookie-to-header-token CSRF protection technique be thwarted by permissive CORS origin header?

According to https://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-header_token The protection provided by this technique can be thwarted if the target website disables its same-...
Eran Medan's user avatar
1 vote
1 answer
3k views

How can I securely disable CSRF validation for native clients when browser clients access the same API?

I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients. How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls? ...
makerofthings7's user avatar