Questions tagged [same-origin-policy]
The same-origin-policy is one of several models that web browsers use to determine which JavaScript files in a webpage should be executed. This is determined by the domain (the origin).
151
questions
2
votes
1
answer
358
views
Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?
The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE.
Is it possible for an attacker to steal the token, using javascript or flash, in ...
CommunityBot
- 1
12
votes
3
answers
3k
views
What attacks are mitigated by requiring CORS for subresource integrity verification?
Can someone elaborate on the attacks alluded to in this paragraph from the W3C SubResource Integrity spec?
In order to mitigate an attacker’s ability to read data cross-origin by brute-forcing ...
- 101
0
votes
1
answer
26
views
Why does the DOM single-origin policy take into account protocol and port? What if it was just domain?
I'm learning the basics of network security and am trying to really understand the single origin policy. I was wondering what the vulnerabilities would be if an origin was only defined by domain, as ...
- 46.2k
5
votes
1
answer
266
views
XSS security concerns from untrusted parent domains
There's lots of discussion about protecting content on example.com from user controlled content on subdomain.example.com (e.g. Github pages). What are the risks the other way around?
If my content is ...
CommunityBot
- 1
1
vote
1
answer
152
views
Can the Origin header have alphabetical port or parameters in a real-life scenario?
I'm testing this application which is properly validating origin header on the sever side. However, if I add any domain and the expect domain as port, application still consider this valid.
Origin: ...
- 350
2
votes
3
answers
217
views
Why don't browsers' same-origin policies allow anonymous cross-origin requests?
Generally I've read the motivation for browser same-origin policies is to prevent data being obtained by an attacker because of the sending of credentials in a cross-origin request, and that if you're ...
- 198k
4
votes
1
answer
7k
views
In which ways could a javascript making a cross domain HEAD request be a threat?
I was just reading this answer to the question Why is the same origin policy so important?
Basically, when you try to make an XMLHttpRequest to a different
domain, the browser will do one of two ...
- 350
17
votes
4
answers
23k
views
How does CSRF correlate with Same Origin Policy
I'm trying to understand what roles do CSRF and same origin play in the grand scheme of things. With CSRF, I'm able to pretty much do anything on other websites on clients by making requests.Same ...
1
vote
2
answers
617
views
Is my understanding of CSRF, SOP and CORS correct (Express / React)?
I am a hobby developer and am developing an application with a Node JS / Express backend and a React frontend.
I am currently learning about Cross Site Request Forgery (CSRF), and I want to make sure ...
- 46.2k
2
votes
3
answers
1k
views
How can the Cookie-to-header-token CSRF protection technique be thwarted by permissive CORS origin header?
According to https://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-header_token
The protection provided by this technique can be thwarted if the
target website disables its same-...
- 350
2
votes
0
answers
57
views
Auth Token not included in CORS exploit [closed]
I have found a CORS on a website but when I am trying to exploit it for a POC it is fetching all the cookies except auth cookies and due to that I am getting an error message to "User not logged ...
5
votes
2
answers
5k
views
What is the connection between CORS and SameSite cookie attribute?
For most of them may be its a silly question but I want it to know this in very simple language.
If an application is not using CORS at all then should we put this SameSite cookie attribute?
and if ...
- 350
2
votes
1
answer
196
views
What does COEP do that CSP doesn't already do?
Both Cross-Origin-Embedder-Policy and Content-Security-Policy seem to do pretty similar things: they restrict the document from loading certain types of subresources (e.g. cross-origin subresources). ...
- 198k
2
votes
2
answers
1k
views
If browser cookies aren't shared between different websites, then why is Same origin Policy useful?
I'm a beginner to Web security and I recently started reading about Same Origin Policy and it's usefulness in preventing a malicious website from interacting with a secure website being used by a user....
CommunityBot
- 1
3
votes
3
answers
4k
views
How is the same origin policy causing my PoC to fail when I don't need to read return data?
I'm performing an authorized vulnerability analysis on a custom web service and have discovered a CSRF vulnerability.
Due to there not being form tokens coupled with the service not checking for the ...
- 34k
0
votes
1
answer
703
views
COOP and COEP: Is there an advantage to enabling COOP / COEP if I don't need to use the sharedArrayBuffer or other features?
COOP: cross origin opener policy
COEP: Cross origin embedder policy
Most of the articles on the web, related to COOP / COEP, point to the fact that by enabling COOP / COEP , your web page can use the ...
- 121
28
votes
7
answers
13k
views
How do hackers trick frontend validation?
I've always read: Put validations in the backend. Frontend validations are for UX, not security. This is because bad actors can trick frontend validation. But I'm having a hard time wrapping my head ...
CommunityBot
- 1
0
votes
1
answer
433
views
Why is Content Security Policy necessary given Same Origin Policy?
Given that Same Origin Policy prevents JavaScript from one origin from running in another origin and accessing another origin's cookies, why is CSP necessary?
Is it that CORS selectively removes some ...
- 22.7k
160
votes
4
answers
88k
views
Why is the same origin policy so important?
I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
0
votes
2
answers
313
views
Is there an issue if application responds with access control allow origin * but there is no allow credentials header?
Since application is not responding with allow credentials header, an attacker can't craft cross domain request with cookies, but I was wondering if allow origin * alone (Without credentials being ...
- 46.2k
2
votes
3
answers
1k
views
Does SOP prevent a class of CSRF attacks?
Just want to settle a debate I'm having with someone.
Suppose there is no SOP. Via an XSS exploit, code can run on website A.com and submit an XHR request to B.com. Suppose B.com stores an auth token ...
- 128k
19
votes
2
answers
10k
views
How is the lack of the "SameSite" cookie flag a risk?
Nowadays cookies can have HTTPOnly, Secure and SameSite flags. The purposes of HTTPOnly and Secure flags are pretty clear. But what does SameSite scripting prevent exactly and how?
Additionally, how ...
- 153
16
votes
1
answer
6k
views
How are Ajax requests vulnerable to CSRF attacks if the Same-origin policy is applied?
What I know about CSRF is that a malicious website tricks a normal user into issuing a request to a trusted website using a form.
I understand that is possible because we can post forms to different ...
- 350
1
vote
2
answers
471
views
With the existence of CORS, what further purpose does same origin policy serve?
I've been using CORS for a while and I think I understand it. But as far as I can tell, because the allow-origin header is provided by the server being called, which an attacker can control as they ...
- 350
0
votes
1
answer
179
views
Is the "same-origin" implied when using "frame-ancestor" in the CSP header?
If my Content-Security-Policy is set to the following:
Content-Security-Policy: frame-ancestors 'self'
Does it also imply:
Content-Security-Policy: default-src 'self'
Or is it a lot safer to put ...
- 987
0
votes
1
answer
457
views
Securing a Websocket Connection in case of XSS Vulnerability
Goal
Authenticate the Client via HTTP Request.
Authenticate the Client's WebSocket connection.
Prevent exploitation of WebSocket connection(when a XSS Vulnerability is present on website).
How I'm ...
- 46.2k
2
votes
1
answer
240
views
Would "same-origin cookies" make sense?
I have read Incrementally Better Cookies, a couple of web.dev articles and tried to google for "same-origin cookies" but could not find anything so I wonder if this is being worked on.
...
- 375
0
votes
1
answer
142
views
How do applications which are integrated using a javascript client side sdk, secure their data or disallow spam?
Take an example of google maps. google maps provides a javascript client SDK, which means any web app running javascript can access the google maps sdk. You need to use an API_KEY so that google can ...
- 283
2
votes
1
answer
2k
views
Doesn't Samesite cookie and Sameorigin policy effectively does the same job?
Pardon me if I am wrong, however, I am looking for an answer for my understanding that isn't the concerns regarding CSRF solved by both Samesite cookie and Same-Origin-Policy effectively? Then why is ...
- 350
3
votes
0
answers
248
views
Cross-Origin-Opener-Policy: unsafe-none
A new HTTP header named Cross-Origin-Opener-Policy has three values:
unsafe-none
same-origin-allow-popups
same-origin
Google's web.dev article about this header explains its effects on other sites (...
- 2,257
6
votes
3
answers
2k
views
Same Origin Policy - XHR response
I know that Same Origin Policy (SOP) prevents a page/script from one origin to read response from another origin, but it does not prevents the page/script from making a XMLHttpRequest (XHR) request to ...
- 34k
0
votes
0
answers
43
views
A potentially simpler same origin policy? [duplicate]
I know there are lots of posts on the same origin policy, but I specifically want to understand why it can't be done in this simpler way.
If evil.com makes sends a request to bank.com, browsers will ...
- 121
2
votes
3
answers
3k
views
Why can I read the response to this CSRF attack?
I have a website www.foo.com:8002 that I have resolve to 127.0.0.1:8002 in my hosts file. I have another (the main site) running at localhost:80
In www.foo.com:8002 the page looks like
<form name=...
- 23
0
votes
1
answer
2k
views
How to bypass origin based csrf protection?
I'm trying to do some csrf attack test on a site.
I found that the site protect itself from csrf by checking the http Origin header.
But I guess maybe under some conditions I can bypass the ...
CommunityBot
- 1
6
votes
5
answers
6k
views
Why doesn't a simple HTTP request to display a remote web page violate the same-origin policy?
On a W3Schools page, I found that HTTP requests work like this:
A client (a browser) sends an HTTP request to the web
A web server receives the request, and runs an application to process it
The ...
- 585
3
votes
2
answers
134
views
Serving "less trusted" content on the same domain
Let's say we run a web app at "example.org". It uses cookies for user authentication.
Our website also has a blog at "example.org/blog", hosted by a third party. Our load ...
CommunityBot
- 1
1
vote
0
answers
396
views
What is meaning of setting port number to NULL in document.domain call?
Here (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it is mentioned
The port number is checked separately by the browser. Any call to document.domain, including document....
- 165
1
vote
0
answers
102
views
Allowing 3rd-party cookies in major 2020 browsers [closed]
I'm trying to get 3rd party cookies to work on major mid-year 2020 browsers [1]. It's as simple as pointing an iframe to an external URL to make a cookied request and probably get the response ...
- 65.4k
1
vote
2
answers
913
views
Why WebSockets doesn't apply SOP?
I can't understand why SOP (same-origin policy) cannot block Cross-Origin WebSocket Hijacking, I just read this article and I can't understand from where WebSocket requests comes from.
From where does ...
- 22.7k
2
votes
1
answer
761
views
Ideas for subdomains isolation
Consider a blogging platform - example.com and we want to host untrusted content in subdomain1.example.com and subdomain2.example.com.
By default, same origin policy doesn't allow communication ...
CommunityBot
- 1
0
votes
0
answers
43
views
DOM access between same-origin tabs [duplicate]
Consider the following website. Page A (https://example.com/login) contains a login form and its password field has the attributes name and id set to "password". Page B (https://example.com/vuln) has ...
- 1
0
votes
2
answers
280
views
Why not sandbox websites instead of using Same-Origin-Policy?
Why do Browsers implement a Same-Origin-Policy (SOP) to prevent open websites in the browser from executing scripts that may access / modify data of other open websites in the used browser?
Another ...
- 18.6k
4
votes
1
answer
5k
views
"Same origin policy" and XSS
I understand SOP, 'Same origin policy' is supposed to prevent script code with origin x from accessing data with origin y. Origin is said to be a tuple of protocol, domain and port.
This explains ...
- 29.5k
8
votes
4
answers
5k
views
How come <img> calls do not violate the Same Origin Policy?
I'm a bit confused regarding the subject of Same Origin Policy (SOP). If I understand correctly, the purpose of the SOP is to prevent one page from obtaining access to sensitive data on another web ...
- 65.4k
6
votes
1
answer
329
views
Why was the Same-origin policy originally introduced (before XMLHttpRequest)?
As I understand it, the Same-origin policy (SOP) basically prevents a script in a web page from obtaining or sending information from/to a different domain.
I understand that this is important to ...
CommunityBot
- 1
5
votes
2
answers
2k
views
Is same origin policy for web only useful because of cookies?
There is a same origin policy in the browser to ensure that e.g. bad site won't read your data from Facebook. But it seems that the only problem that it tries to solve is that cookies are ...
- 1,643
1
vote
0
answers
374
views
Do best practices eliminate the need for a CSRF token when writing an API server?
I realize that OWASP recommends CSRF tokens but I rarely see them used with public standalone HTTP APIs. This would seem to indicate that they're not always necessary.
To make this a little more ...
- 111
1
vote
1
answer
784
views
Same origin policy for CSRF attack?
Per mine understanding, by default same origin policy(SOP) is enabled by default by all browsers. This means that a web browser permits scripts contained in a first web page to access data in a ...
- 29.5k
0
votes
2
answers
2k
views
CORS Anywhere to bypass CSRF protection
CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers.
Can CORS Anywhere be used to bypass CSRF protection?
Reason to ask ...
- 30.9k
1
vote
1
answer
3k
views
ReverseProxy and PCI Compliance
My company has a PCI compliant billing gateway and they expose a service for submitting credit card payment details.
I am writing a (Single Page Application/end-to-end javascript) website for them ...
- 103