Questions tagged [same-origin-policy]
The same-origin-policy is one of several models that web browsers use to determine which JavaScript files in a webpage should be executed. This is determined by the domain (the origin).
31
questions
161
votes
4
answers
89k
views
Why is the same origin policy so important?
I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
- 2,259
57
votes
2
answers
88k
views
Why is the Access-Control-Allow-Origin header necessary?
I understand the purpose of the Access-Control-Allow-Credentials header, but can't see what problem the Access-Control-Allow-Origin header solves.
More precisely, it's easy to see how, if cross-...
- 1,827
17
votes
4
answers
25k
views
How does CSRF correlate with Same Origin Policy
I'm trying to understand what roles do CSRF and same origin play in the grand scheme of things. With CSRF, I'm able to pretty much do anything on other websites on clients by making requests.Same ...
- 179
7
votes
1
answer
2k
views
Why CSRF's JS can't read token by GETting html
1) User is logged in bank.com in one tab, where everything is secured by CSRF tokens. Then he opens evil.com in another tab.
2) Javascript in evil.com might try to make a POST request to bank.com/...
- 419
11
votes
2
answers
2k
views
User-specific Subdomains : JavaScript security
If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
Brandon
4
votes
3
answers
2k
views
Flash ignores Content-Type header, allowing XSS?
I recently read that the Flash plugin ignores the Content-Type header in certain circumstances. In particular, you can give Flash a URL, and the Flash plugin will happily fetch the content at that ...
- 100k
21
votes
3
answers
6k
views
What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?
I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue.
Since JSONP bypasses same-...
- 311
19
votes
2
answers
10k
views
Using iframes to sandbox untrusted code
I'm trying to create an extensible platform, where my site will provide a model and some views (both client-side, in the browser) and third party sites may add their own views as well. The goal here ...
- 2,935
8
votes
1
answer
2k
views
Child iFrame hash verification of parent iFrame content
Consider the following scenario:
Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not ...
- 872
47
votes
3
answers
10k
views
Why don't browsers block cross-site POSTs by default?
Same-origin policy (SOP) makes browsers block scripting from one origin to mess with another, unless explicitly being told not to do so. But cross-site POSTs are still allowed, creating the vector for ...
- 585
17
votes
3
answers
13k
views
Do browsers allows pages loaded on one tab to access/intercept/inject data in other tabs?
I was surprised to hear from this Reuters video that it was possible for a page loaded on one tab to access and/or inject data onto another page loaded on a different tab.
TL;DW (too lazy; didn't ...
- 173
8
votes
4
answers
839
views
Same-origin policy for desktop application?
The same-origin policy is one of the most important security feature in our browser.
It basically provides sandboxing for our applications which is protecting our users.
Desktop application can read ...
- 7,021
5
votes
1
answer
867
views
How does the same-origin-policy protect against PUT/DELETE CSRF?
I've read the OWASP guide for cross-site request forgery and it states that "other HTTP methods", such as PUT and DELETE could be theoretically used for CSRF.
However with the same-origin-policy ...
- 265
3
votes
1
answer
3k
views
How does the same-origin policy apply between browser tabs? [duplicate]
Let's assume that we have 2 open tabs in a browser containing page A (A.html, A.js) into the first tab and page B (B.html, B.js) into the second tab and that page A and B have the same origin (scheme, ...
- 439
3
votes
1
answer
3k
views
Doesn't Samesite cookie and Sameorigin policy effectively does the same job?
Pardon me if I am wrong, however, I am looking for an answer for my understanding that isn't the concerns regarding CSRF solved by both Samesite cookie and Same-Origin-Policy effectively? Then why is ...
- 58
1
vote
2
answers
565
views
With the existence of CORS, what further purpose does same origin policy serve?
I've been using CORS for a while and I think I understand it. But as far as I can tell, because the allow-origin header is provided by the server being called, which an attacker can control as they ...
- 171
17
votes
1
answer
6k
views
How are Ajax requests vulnerable to CSRF attacks if the Same-origin policy is applied?
What I know about CSRF is that a malicious website tricks a normal user into issuing a request to a trusted website using a form.
I understand that is possible because we can post forms to different ...
- 271
7
votes
1
answer
3k
views
Same-origin policy for file: URLs in Android browser?
When you load a file:// URL in an Android WebView or in the Android browser, what does it treat as the origin? What can the Javascript on that page access? Can it access other files in the same ...
- 100k
6
votes
1
answer
2k
views
Does returning Access-Control-Allow-Origin: * weaken the security of JSON GET responses?
The W3C CORS recommendation states:
Certain types of resources should not attempt to specify
particular authorized origins, but instead either deny or allow
all origins.
...
3. A GET ...
- 161
6
votes
3
answers
3k
views
Same Origin Policy - XHR response
I know that Same Origin Policy (SOP) prevents a page/script from one origin to read response from another origin, but it does not prevents the page/script from making a XMLHttpRequest (XHR) request to ...
6
votes
1
answer
2k
views
Why is a child window allowed to change the location of its parent?
Maybe a silly question. When opening a new tab via target="_blank", the page that loads in that tab is allowed to set a new location in the parent tab using:
window.opener.location.replace('http://...
- 345
6
votes
1
answer
2k
views
SSO via HMAC and shared key. Can this be improved?
Given an authenticated user on A.com, we want to redirect the user to B.com so that she'll be immedaitely authenticated. The scheme I'm considering is very basic:
A.com and B.com both share key S.
...
- 205
3
votes
1
answer
2k
views
Access-Control-Allow-Origin wihout AJAX
This answer (incorrectly?) states
No, as long as the CORS Access-Control-Allow-Origin is at its default restrictive value. This prevents the outer website from accessing the framed website via ...
- 34.3k
3
votes
2
answers
3k
views
If browser cookies aren't shared between different websites, then why is Same origin Policy useful?
I'm a beginner to Web security and I recently started reading about Same Origin Policy and it's usefulness in preventing a malicious website from interacting with a secure website being used by a user....
- 31
3
votes
3
answers
855
views
Understanding SOP in multiple tabs
I am reading another answer on this website.
It says:
Assume you are logged into Facebook and visit a malicious website in
another browser tab. Without the same origin policy JavaScript on that
...
- 1,095
3
votes
1
answer
3k
views
Understanding Same origin policy
I am trying to understand same origin policy better. From what I understand same origin policy restricts code from one "origin" not access data from another "origin". What I am trying to understand is ...
- 903
3
votes
1
answer
436
views
What servers or clients are immune to related-domain cookie attacks? (*.example.com)
In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com).
Lacking any tangible solution, ...
- 51k
1
vote
1
answer
197
views
Can the Origin header have alphabetical port or parameters in a real-life scenario?
I'm testing this application which is properly validating origin header on the sever side. However, if I add any domain and the expect domain as port, application still consider this valid.
Origin: ...
- 11
0
votes
1
answer
636
views
Securing a Websocket Connection in case of XSS Vulnerability
Goal
Authenticate the Client via HTTP Request.
Authenticate the Client's WebSocket connection.
Prevent exploitation of WebSocket connection(when a XSS Vulnerability is present on website).
How I'm ...
- 3
0
votes
1
answer
443
views
Prevent javascript cross-origin write
Let's assume an attacker manages to inject this script in a login page:
const form = document.getElementsByTagName('form')[0];
form.addEventListener('submit', stealCredentials);
function ...
- 222
0
votes
1
answer
1k
views
Same Origin Policy and CSRF-Tokens
If we trust browsers that they satisfy Same Origin Policy without bugs, would we still need CSRF-tokens?
Assuming server doesn't have CORS enabled:
As far as I know we are not allowed to do POST ...
- 358