Questions tagged [same-origin-policy]

The same-origin-policy is one of several models that web browsers use to determine which JavaScript files in a webpage should be executed. This is determined by the domain (the origin).

Filter by
Sorted by
Tagged with
0
votes
1answer
29 views

Is the "same-origin" implied when using "frame-ancestor" in the CSP header?

If my Content-Security-Policy is set to the following: Content-Security-Policy: frame-ancestors 'self' Does it also imply: Content-Security-Policy: default-src 'self' Or is it a lot safer to put ...
0
votes
1answer
70 views

Securing a Websocket Connection in case of XSS Vulnerability

Goal Authenticate the Client via HTTP Request. Authenticate the Client's WebSocket connection. Prevent exploitation of WebSocket connection(when a XSS Vulnerability is present on website). How I'm ...
2
votes
1answer
75 views

Would "same-origin cookies" make sense?

I have read Incrementally Better Cookies, a couple of web.dev articles and tried to google for "same-origin cookies" but could not find anything so I wonder if this is being worked on. ...
0
votes
1answer
63 views

How do applications which are integrated using a javascript client side sdk, secure their data or disallow spam?

Take an example of google maps. google maps provides a javascript client SDK, which means any web app running javascript can access the google maps sdk. You need to use an API_KEY so that google can ...
0
votes
1answer
78 views

Is there an issue if application responds with access control allow origin * but there is no allow credentials header?

Since application is not responding with allow credentials header, an attacker can't craft cross domain request with cookies, but I was wondering if allow origin * alone (Without credentials being ...
3
votes
0answers
49 views

Cross-Origin-Opener-Policy: unsafe-none

A new HTTP header named Cross-Origin-Opener-Policy has three values: unsafe-none same-origin-allow-popups same-origin Google's web.dev article about this header explains its effects on other sites (...
0
votes
1answer
47 views

Can the Origin header have alphabetical port or parameters in a real-life scenario?

I'm testing this application which is properly validating origin header on the sever side. However, if I add any domain and the expect domain as port, application still consider this valid. Origin: ...
27
votes
7answers
9k views

How do hackers trick frontend validation?

I've always read: Put validations in the backend. Frontend validations are for UX, not security. This is because bad actors can trick frontend validation. But I'm having a hard time wrapping my head ...
0
votes
0answers
42 views

A potentially simpler same origin policy? [duplicate]

I know there are lots of posts on the same origin policy, but I specifically want to understand why it can't be done in this simpler way. If evil.com makes sends a request to bank.com, browsers will ...
6
votes
5answers
5k views

Why doesn't a simple HTTP request to display a remote web page violate the same-origin policy?

On a W3Schools page, I found that HTTP requests work like this: A client (a browser) sends an HTTP request to the web A web server receives the request, and runs an application to process it The ...
1
vote
0answers
137 views

What is meaning of setting port number to NULL in document.domain call?

Here (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it is mentioned The port number is checked separately by the browser. Any call to document.domain, including document....
3
votes
2answers
64 views

Serving "less trusted" content on the same domain

Let's say we run a web app at "example.org". It uses cookies for user authentication. Our website also has a blog at "example.org/blog", hosted by a third party. Our load ...
1
vote
0answers
61 views

Allowing 3rd-party cookies in major 2020 browsers [closed]

I'm trying to get 3rd party cookies to work on major mid-year 2020 browsers [1]. It's as simple as pointing an iframe to an external URL to make a cookied request and probably get the response ...
0
votes
2answers
248 views

Why WebSockets doesn't apply SOP?

I can't understand why SOP (same-origin policy) cannot block Cross-Origin WebSocket Hijacking, I just read this article and I can't understand from where WebSocket requests comes from. From where does ...
2
votes
1answer
604 views

What is the connection between CORS and SameSite cookie attribute?

For most of them may be its a silly question but I want it to know this in very simple language. If an application is not using CORS at all then should we put this SameSite cookie attribute? and if ...
0
votes
1answer
637 views

How to bypass origin based csrf protection?

I'm trying to do some csrf attack test on a site. I found that the site protect itself from csrf by checking the http Origin header. But I guess maybe under some conditions I can bypass the ...
2
votes
1answer
184 views

Ideas for subdomains isolation

Consider a blogging platform - example.com and we want to host untrusted content in subdomain1.example.com and subdomain2.example.com. By default, same origin policy doesn't allow communication ...
1
vote
2answers
166 views

With the existence of CORS, what further purpose does same origin policy serve?

I've been using CORS for a while and I think I understand it. But as far as I can tell, because the allow-origin header is provided by the server being called, which an attacker can control as they ...
2
votes
1answer
639 views

Doesn't Samesite cookie and Sameorigin policy effectively does the same job?

Pardon me if I am wrong, however, I am looking for an answer for my understanding that isn't the concerns regarding CSRF solved by both Samesite cookie and Same-Origin-Policy effectively? Then why is ...
0
votes
0answers
41 views

DOM access between same-origin tabs [duplicate]

Consider the following website. Page A (https://example.com/login) contains a login form and its password field has the attributes name and id set to "password". Page B (https://example.com/vuln) has ...
0
votes
2answers
148 views

Why not sandbox websites instead of using Same-Origin-Policy?

Why do Browsers implement a Same-Origin-Policy (SOP) to prevent open websites in the browser from executing scripts that may access / modify data of other open websites in the used browser? Another ...
3
votes
1answer
2k views

"Same origin policy" and XSS

I understand SOP, 'Same origin policy' is supposed to prevent script code with origin x from accessing data with origin y. Origin is said to be a tuple of protocol, domain and port. This explains ...
6
votes
1answer
148 views

Why was the Same-origin policy originally introduced (before XMLHttpRequest)?

As I understand it, the Same-origin policy (SOP) basically prevents a script in a web page from obtaining or sending information from/to a different domain. I understand that this is important to ...
1
vote
0answers
190 views

Do best practices eliminate the need for a CSRF token when writing an API server?

I realize that OWASP recommends CSRF tokens but I rarely see them used with public standalone HTTP APIs. This would seem to indicate that they're not always necessary. To make this a little more ...
1
vote
1answer
269 views

Same origin policy for CSRF attack?

Per mine understanding, by default same origin policy(SOP) is enabled by default by all browsers. This means that a web browser permits scripts contained in a first web page to access data in a ...
42
votes
7answers
5k views

Will the same JavaScript fetched by HTTP and HTTPS be cached separately by the browser?

Say that a web server supports both HTTP and HTTPS. If a browser fetches the same JavaScript with a HTTP GET and a HTTPS GET, and the JavaScript is cache-able, will the browser cache two copies of the ...
0
votes
2answers
3k views

Why is it not possible to spoof referer and origin header with XHR?

Technically speaking, it is possible to spoof both headers using an intercepting proxy but that's useless because we are doing it ourselves as an attacker. When we send an ajax request using JS from ...
0
votes
1answer
100 views

Remote extraction of passwords from browser password managers

I'm writing an essay about "Browser Password Managers". As part of this I have to write about vulnerabilities and exploits. I stumbled across the following scientific paper from 2013: "Password ...
0
votes
2answers
134 views

Can JavaScript from different origins communicate securely

I want to know if there is a way for JS from one Origin to delegate a task to JS from another origin in a secure way. The use case is to have a JS Agent from the users' home origin use the ...
1
vote
1answer
152 views

Who can access the X-CSRF token?

I'm really confused about a CSRF token implementation in a Spring web app that I've inherited. Basically, everyone can request the token by looking at what Spring Security filters do: http ...
1
vote
1answer
276 views

Difficulty understanding SOP and CSRF

As said here, a CSRF attack has little to do with SOP. However, on the OWASP CSRF page it is said that Fortunately, this request will not be executed by modern web browsers thanks to same-origin ...
3
votes
1answer
566 views

Why are web font resource requests not no-cors?

CSS, JS, images etc are all fetched as no-cors. What's different about web fonts? Per the spec: For font loads, user agents must use the potentially CORS-enabled fetch method defined by the [FETCH]...
1
vote
2answers
208 views

Are subdomains secure from one another if they are on separate servers?

I'm writing an application (example.com) that gives users their own sub-domains to run arbitrary user applications off of (user.example.com). Each user application will be run on separate servers ...
1
vote
1answer
126 views

How can the Same Origin Policy protect the user in times of CORS headers?

How can the Same origin policy protect something if you can bypass it via Cross Origin Resource Sharing headers? And why are those assigned by the server which is tried to access and not by the user? ...
0
votes
2answers
1k views

CORS Anywhere to bypass CSRF protection

CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers. Can CORS Anywhere be used to bypass CSRF protection? Reason to ask ...
0
votes
1answer
302 views

DNS Spoofing Detection with JavaScript

I've came across an interesting question today - how can a JavaScript detect that a DNS Spoofing attack has been made against the client its running upon? Scenario: Edit: wrong scenario was ...
0
votes
1answer
60 views

Custom JavaScript injection allowed in DOM of other origins [closed]

I am performing a security research on a development framework for thick client & mobile applications. The framework allows developers to inject custom JavaScript in the DOM of any origin. This ...
1
vote
3answers
572 views

How can the Cookie-to-header-token CSRF protection technique be thwarted by permissive CORS origin header?

According to https://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-header_token The protection provided by this technique can be thwarted if the target website disables its same-...
1
vote
1answer
1k views

How can I securely disable CSRF validation for native clients when browser clients access the same API?

I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients. How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls? ...
0
votes
1answer
212 views

Prevent javascript cross-origin write

Let's assume an attacker manages to inject this script in a login page: const form = document.getElementsByTagName('form')[0]; form.addEventListener('submit', stealCredentials); function ...
3
votes
1answer
274 views

Why does not Referer header use “same-origin” by default?

Same origin policy is an important part of the security model so it is "on" by default for most things, but for the referer it does not seem to be so. The default for browsers seem to be no-referrer-...
3
votes
1answer
1k views

Web-Application with CORS Origin: * using authorization header

As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote: When responding to a credentialed request, the server must specify an ...
3
votes
1answer
693 views

Why is the same origin policy sensible - for requests?

This is not the same question as Why is the same origin policy so important?. That one asks only about why cookies are only ever send to origin they came from, which I understand. What I don't ...
6
votes
4answers
3k views

How come <img> calls do not violate the Same Origin Policy?

I'm a bit confused regarding the subject of Same Origin Policy (SOP). If I understand correctly, the purpose of the SOP is to prevent one page from obtaining access to sensitive data on another web ...
3
votes
0answers
106 views

What are the design considerations behind exempting WebSockets from the SOP?

I was rather surprised that in my experiments, I could simply connect from one website to a WebSocket server on a different domain/port pair. Subsequent research repeatedly showed that WebSockets do ...
2
votes
1answer
2k views

Why are cross-domain POST requests allowed? [duplicate]

I understand that best practice is to use tokens to prevent CSRF, but why do browsers permit cross-site POST requests in the first place? It seems like giving untrusted parties unfettered write ...
1
vote
1answer
891 views

Is CORS and CSRF-tokens only for POST and GET requests? [closed]

I have the following questions regarding CSRF, SOP and CORS. Does CSRF tokens only protect form submission with either POST or GET methods? Is this just a "common practice" (regarding the fact that ...
46
votes
3answers
10k views

Why don't browsers block cross-site POSTs by default?

Same-origin policy (SOP) makes browsers block scripting from one origin to mess with another, unless explicitly being told not to do so. But cross-site POSTs are still allowed, creating the vector for ...
0
votes
3answers
527 views

Why can't bypass SOP using "src" attribut in script tag?

I'm not familiar with Javascript, but I want to know what can't be done in this steps in order to bypass SOP and extract sensitive data : set the tag <script src="https://facebook.com/messages">...
4
votes
0answers
4k views

Configure Access-Control-Allow-Origin for clients with origin: null

I develop a web app. When I run the app on Android, origin in the header of a network request is null. Access-Control-Allow-Origin in the response header is null too, because the origin of the ...