Questions tagged [same-origin-policy]

The same-origin-policy is one of several models that web browsers use to determine which JavaScript files in a webpage should be executed. This is determined by the domain (the origin).

Filter by
Sorted by
Tagged with
1
vote
1answer
49 views

What is the connection between CORS and SameSite cookie attribute?

For most of them may be its a silly question but I want it to know this in very simple language. If an application is not using CORS at all then should we put this SameSite cookie attribute? and if ...
0
votes
0answers
72 views

How to bypass origin based csrf protection?

I'm trying to do some csrf attack test on a site. I found that the site protect itself from csrf by checking the http Origin header. But I guess maybe under some conditions I can bypass the ...
2
votes
1answer
78 views

Ideas for subdomains isolation

Consider a blogging platform - example.com and we want to host untrusted content in subdomain1.example.com and subdomain2.example.com. By default, same origin policy doesn't allow communication ...
1
vote
2answers
109 views

With the existance of CORS, what further purpose does same origin policy serve?

I've been using CORS for a while and I think I understand it. But as far as I can tell, because the allow-origin header is provided by the server being called, which an attacker can control as they ...
0
votes
1answer
128 views

Doesn't Samesite cookie and Sameorigin policy effectively does the same job?

Pardon me if I am wrong, however, I am looking for an answer for my understanding that isn't the concerns regarding CSRF solved by both Samesite cookie and Same-Origin-Policy effectively? Then why is ...
0
votes
0answers
39 views

DOM access between same-origin tabs [duplicate]

Consider the following website. Page A (https://example.com/login) contains a login form and its password field has the attributes name and id set to "password". Page B (https://example.com/vuln) has ...
0
votes
2answers
99 views

Why not sandbox websites instead of using Same-Origin-Policy?

Why do Browsers implement a Same-Origin-Policy (SOP) to prevent open websites in the browser from executing scripts that may access / modify data of other open websites in the used browser? Another ...
2
votes
1answer
520 views

“Same origin policy” and XSS

I understand SOP, 'Same origin policy' is supposed to prevent script code with origin x from accessing data with origin y. Origin is said to be a tuple of protocol, domain and port. This explains ...
6
votes
1answer
98 views

Why was the Same-origin policy originally introduced (before XMLHttpRequest)?

As I understand it, the Same-origin policy (SOP) basically prevents a script in a web page from obtaining or sending information from/to a different domain. I understand that this is important to ...
0
votes
0answers
70 views

Do best practices eliminate the need for a CSRF token when writing an API server?

I realize that OWASP recommends CSRF tokens but I rarely see them used with public standalone HTTP APIs. This would seem to indicate that they're not always necessary. To make this a little more ...
1
vote
1answer
105 views

Same origin policy for CSRF attack?

Per mine understanding, by default same origin policy(SOP) is enabled by default by all browsers. This means that a web browser permits scripts contained in a first web page to access data in a ...
42
votes
7answers
5k views

Will the same JavaScript fetched by HTTP and HTTPS be cached separately by the browser?

Say that a web server supports both HTTP and HTTPS. If a browser fetches the same JavaScript with a HTTP GET and a HTTPS GET, and the JavaScript is cache-able, will the browser cache two copies of the ...
0
votes
2answers
333 views

Why is it not possible to spoof referer and origin header with XHR?

Technically speaking, it is possible to spoof both headers using an intercepting proxy but that's useless because we are doing it ourselves as an attacker. When we send an ajax request using JS from ...
0
votes
1answer
94 views

Remote extraction of passwords from browser password managers

I'm writing an essay about "Browser Password Managers". As part of this I have to write about vulnerabilities and exploits. I stumbled across the following scientific paper from 2013: "Password ...
0
votes
2answers
114 views

Can JavaScript from different origins communicate securely

I want to know if there is a way for JS from one Origin to delegate a task to JS from another origin in a secure way. The use case is to have a JS Agent from the users' home origin use the ...
0
votes
0answers
29 views

Preventing Quota Theft of Embedded Service without API Key

The way the service works is that the user can embed content on their site, that is served from my servers. Usage is tracked in "views", or how many times the src endpoint inside of the <iframe> ...
1
vote
1answer
123 views

Who can access the X-CSRF token?

I'm really confused about a CSRF token implementation in a Spring web app that I've inherited. Basically, everyone can request the token by looking at what Spring Security filters do: http ...
1
vote
1answer
201 views

Difficulty understanding SOP and CSRF

As said here, a CSRF attack has little to do with SOP. However, on the OWASP CSRF page it is said that Fortunately, this request will not be executed by modern web browsers thanks to same-origin ...
1
vote
1answer
195 views

Why are web font resource requests not no-cors?

CSS, JS, images etc are all fetched as no-cors. What's different about web fonts? Per the spec: For font loads, user agents must use the potentially CORS-enabled fetch method defined by the [FETCH]...
1
vote
2answers
185 views

Are subdomains secure from one another if they are on separate servers?

I'm writing an application (example.com) that gives users their own sub-domains to run arbitrary user applications off of (user.example.com). Each user application will be run on separate servers ...
1
vote
1answer
112 views

How can the Same Origin Policy protect the user in times of CORS headers?

How can the Same origin policy protect something if you can bypass it via Cross Origin Resource Sharing headers? And why are those assigned by the server which is tried to access and not by the user? ...
0
votes
2answers
782 views

CORS Anywhere to bypass CSRF protection

CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers. Can CORS Anywhere be used to bypass CSRF protection? Reason to ask ...
0
votes
1answer
175 views

DNS Spoofing Detection with JavaScript

I've came across an interesting question today - how can a JavaScript detect that a DNS Spoofing attack has been made against the client its running upon? Scenario: Edit: wrong scenario was ...
0
votes
1answer
58 views

Custom JavaScript injection allowed in DOM of other origins [closed]

I am performing a security research on a development framework for thick client & mobile applications. The framework allows developers to inject custom JavaScript in the DOM of any origin. This ...
1
vote
2answers
298 views

How can the Cookie-to-header-token CSRF protection technique be thwarted by permissive CORS origin header?

According to https://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-header_token The protection provided by this technique can be thwarted if the target website disables its same-...
1
vote
1answer
866 views

How can I securely disable CSRF validation for native clients when browser clients access the same API?

I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients. How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls? ...
0
votes
1answer
167 views

Prevent javascript cross-origin write

Let's assume an attacker manages to inject this script in a login page: const form = document.getElementsByTagName('form')[0]; form.addEventListener('submit', stealCredentials); function ...
3
votes
1answer
229 views

Why does not Referer header use “same-origin” by default?

Same origin policy is an important part of the security model so it is "on" by default for most things, but for the referer it does not seem to be so. The default for browsers seem to be no-referrer-...
2
votes
1answer
1k views

Web-Application with CORS Origin: * using authorization header

As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote: When responding to a credentialed request, the server must specify an ...
3
votes
1answer
557 views

Why is the same origin policy sensible - for requests?

This is not the same question as Why is the same origin policy so important?. That one asks only about why cookies are only ever send to origin they came from, which I understand. What I don't ...
6
votes
4answers
1k views

How come <img> calls do not violate the Same Origin Policy?

I'm a bit confused regarding the subject of Same Origin Policy (SOP). If I understand correctly, the purpose of the SOP is to prevent one page from obtaining access to sensitive data on another web ...
3
votes
0answers
97 views

What are the design considerations behind exempting WebSockets from the SOP?

I was rather surprised that in my experiments, I could simply connect from one website to a WebSocket server on a different domain/port pair. Subsequent research repeatedly showed that WebSockets do ...
2
votes
1answer
2k views

Why are cross-domain POST requests allowed? [duplicate]

I understand that best practice is to use tokens to prevent CSRF, but why do browsers permit cross-site POST requests in the first place? It seems like giving untrusted parties unfettered write ...
1
vote
1answer
705 views

Is CORS and CSRF-tokens only for POST and GET requests? [closed]

I have the following questions regarding CSRF, SOP and CORS. Does CSRF tokens only protect form submission with either POST or GET methods? Is this just a "common practice" (regarding the fact that ...
45
votes
3answers
9k views

Why don't browsers block cross-site POSTs by default?

Same-origin policy (SOP) makes browsers block scripting from one origin to mess with another, unless explicitly being told not to do so. But cross-site POSTs are still allowed, creating the vector for ...
0
votes
3answers
376 views

Why can't bypass SOP using “src” attribut in script tag?

I'm not familiar with Javascript, but I want to know what can't be done in this steps in order to bypass SOP and extract sensitive data : set the tag <script src="https://facebook.com/messages">...
4
votes
0answers
4k views

Configure Access-Control-Allow-Origin for clients with origin: null

I develop a web app. When I run the app on Android, origin in the header of a network request is null. Access-Control-Allow-Origin in the response header is null too, because the origin of the ...
2
votes
2answers
642 views

CSRF testing of an api endpoint using GET requests

I have an api endpoint that returns a new api token in JSON to the user if they're logged in to my website with only their session cookies being used to authenticate. I'm trying to write a piece of ...
4
votes
0answers
2k views

Is Cross Site History Manipulation (XSHM) still relevant?

XSHM is a vulnerability which exploits the fact that the browser history object does not follow the Same Origin Policy and hence by tracking the changes made to this object we may be able to track a ...
5
votes
1answer
270 views

Are restrictive same origin policies necessary?

The question is for the security community to resolve some misunderstandings here. The crux: Company (Wire) has a client (official-client.com) and a server code (e.g. official-server.com ). CORS ...
9
votes
1answer
899 views

Why is a “tainted canvas” a risk?

I understand the concern about a tainted canvas - the idea that the bits of an image from another site can be sent back to a malicious server. But can you explain the details of how exactly this works?...
0
votes
1answer
60 views

Can Origin headers be sent with get variables or the whole url?

An application I'm working on responds to a wildcard Origin header by setting the Access-Control-Allow-Origin to subdomain.app.com if ending with .app.com. However, if I append .app.com to a GET ...
3
votes
2answers
3k views

Is it safe to set “Access Control Allow Origin” header's value to the “Origin” header's value which is implicitly set by the browser?

I was testing a website and noticed that changing the "Origin" Header's value of a request with an intercepting proxy application results in the web application sending a response with "Access Control ...
0
votes
2answers
370 views

Same origin policy pentesting?

As we all know that what is the SOP? As its very popular. But my question arises when, pentesting this functionality. AS SOP provide the website to call the resources only from its domain. Ex. http: /...
1
vote
2answers
2k views

Is a single page application naturally breaking the same-origin policy?

Assume that you have a web application. The backend API is deployed at api.example.com and your frontend SPA is deployed at frontend.example.com. When you open it you download all the resources to ...
0
votes
1answer
779 views

GitHub pages and same origin

I am working with the security team at my work to get a website accredited before I can publish it...It is a very simple webpage hosted on Github pages with only some javascript. I kind of reached a ...
2
votes
1answer
5k views

Using data URIs to perform XSS in anchor tags - vulnerability? [duplicate]

I've been looking at a few issues related to XSS. In doing so, I've stumbled upon a few "XSS Filter Evasion" type checklists that demonstrate supposed XSS via data URIs. For example: The last line of:...
1
vote
1answer
121 views

what prevents sending “$.post” from one domain to another?

I have one website in chromium tab, and an other website in another tab, Im executing single post command in the second website - $.post(...); to the first website. Originaly its not working (getting: ...
1
vote
1answer
853 views

Crossdomain.xml - write access to domain

Is a permissive crossdomain.xml Flash policy analogous to a permissive CORS policy? i.e. Is <cross-domain-policy> <allow-access-from domain="*" /> </cross-domain-policy> the ...
1
vote
3answers
932 views

CSRF not working over CORS proxy

I'm consuming OData services from JQuery and running into a typical scenario of Same Origin Policy. I do not have control over the server and therefore I can not implement CORS so the only thing I can ...