Questions tagged [same-origin-policy]
The same-origin-policy is one of several models that web browsers use to determine which JavaScript files in a webpage should be executed. This is determined by the domain (the origin).
151
questions
0
votes
1
answer
29
views
Why does the DOM single-origin policy take into account protocol and port? What if it was just domain?
I'm learning the basics of network security and am trying to really understand the single origin policy. I was wondering what the vulnerabilities would be if an origin was only defined by domain, as ...
2
votes
3
answers
233
views
Why don't browsers' same-origin policies allow anonymous cross-origin requests?
Generally I've read the motivation for browser same-origin policies is to prevent data being obtained by an attacker because of the sending of credentials in a cross-origin request, and that if you're ...
- 314
2
votes
0
answers
59
views
Auth Token not included in CORS exploit [closed]
I have found a CORS on a website but when I am trying to exploit it for a POC it is fetching all the cookies except auth cookies and due to that I am getting an error message to "User not logged ...
2
votes
1
answer
199
views
What does COEP do that CSP doesn't already do?
Both Cross-Origin-Embedder-Policy and Content-Security-Policy seem to do pretty similar things: they restrict the document from loading certain types of subresources (e.g. cross-origin subresources). ...
1
vote
2
answers
647
views
Is my understanding of CSRF, SOP and CORS correct (Express / React)?
I am a hobby developer and am developing an application with a Node JS / Express backend and a React frontend.
I am currently learning about Cross Site Request Forgery (CSRF), and I want to make sure ...
- 11
2
votes
2
answers
1k
views
If browser cookies aren't shared between different websites, then why is Same origin Policy useful?
I'm a beginner to Web security and I recently started reading about Same Origin Policy and it's usefulness in preventing a malicious website from interacting with a secure website being used by a user....
- 21
0
votes
1
answer
444
views
Why is Content Security Policy necessary given Same Origin Policy?
Given that Same Origin Policy prevents JavaScript from one origin from running in another origin and accessing another origin's cookies, why is CSP necessary?
Is it that CORS selectively removes some ...
- 494
0
votes
1
answer
721
views
COOP and COEP: Is there an advantage to enabling COOP / COEP if I don't need to use the sharedArrayBuffer or other features?
COOP: cross origin opener policy
COEP: Cross origin embedder policy
Most of the articles on the web, related to COOP / COEP, point to the fact that by enabling COOP / COEP , your web page can use the ...
- 283
2
votes
3
answers
1k
views
Does SOP prevent a class of CSRF attacks?
Just want to settle a debate I'm having with someone.
Suppose there is no SOP. Via an XSS exploit, code can run on website A.com and submit an XHR request to B.com. Suppose B.com stores an auth token ...
- 31
0
votes
1
answer
186
views
Is the "same-origin" implied when using "frame-ancestor" in the CSP header?
If my Content-Security-Policy is set to the following:
Content-Security-Policy: frame-ancestors 'self'
Does it also imply:
Content-Security-Policy: default-src 'self'
Or is it a lot safer to put ...
- 997
0
votes
1
answer
467
views
Securing a Websocket Connection in case of XSS Vulnerability
Goal
Authenticate the Client via HTTP Request.
Authenticate the Client's WebSocket connection.
Prevent exploitation of WebSocket connection(when a XSS Vulnerability is present on website).
How I'm ...
- 3
2
votes
1
answer
245
views
Would "same-origin cookies" make sense?
I have read Incrementally Better Cookies, a couple of web.dev articles and tried to google for "same-origin cookies" but could not find anything so I wonder if this is being worked on.
...
- 375
0
votes
1
answer
143
views
How do applications which are integrated using a javascript client side sdk, secure their data or disallow spam?
Take an example of google maps. google maps provides a javascript client SDK, which means any web app running javascript can access the google maps sdk. You need to use an API_KEY so that google can ...
- 283
0
votes
2
answers
317
views
Is there an issue if application responds with access control allow origin * but there is no allow credentials header?
Since application is not responding with allow credentials header, an attacker can't craft cross domain request with cookies, but I was wondering if allow origin * alone (Without credentials being ...
- 1
3
votes
0
answers
249
views
Cross-Origin-Opener-Policy: unsafe-none
A new HTTP header named Cross-Origin-Opener-Policy has three values:
unsafe-none
same-origin-allow-popups
same-origin
Google's web.dev article about this header explains its effects on other sites (...
- 2,257
1
vote
1
answer
155
views
Can the Origin header have alphabetical port or parameters in a real-life scenario?
I'm testing this application which is properly validating origin header on the sever side. However, if I add any domain and the expect domain as port, application still consider this valid.
Origin: ...
- 11
28
votes
7
answers
14k
views
How do hackers trick frontend validation?
I've always read: Put validations in the backend. Frontend validations are for UX, not security. This is because bad actors can trick frontend validation. But I'm having a hard time wrapping my head ...
0
votes
0
answers
43
views
A potentially simpler same origin policy? [duplicate]
I know there are lots of posts on the same origin policy, but I specifically want to understand why it can't be done in this simpler way.
If evil.com makes sends a request to bank.com, browsers will ...
- 121
6
votes
5
answers
6k
views
Why doesn't a simple HTTP request to display a remote web page violate the same-origin policy?
On a W3Schools page, I found that HTTP requests work like this:
A client (a browser) sends an HTTP request to the web
A web server receives the request, and runs an application to process it
The ...
- 81
1
vote
0
answers
404
views
What is meaning of setting port number to NULL in document.domain call?
Here (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it is mentioned
The port number is checked separately by the browser. Any call to document.domain, including document....
- 165
3
votes
2
answers
135
views
Serving "less trusted" content on the same domain
Let's say we run a web app at "example.org". It uses cookies for user authentication.
Our website also has a blog at "example.org/blog", hosted by a third party. Our load ...
- 172
1
vote
0
answers
103
views
Allowing 3rd-party cookies in major 2020 browsers [closed]
I'm trying to get 3rd party cookies to work on major mid-year 2020 browsers [1]. It's as simple as pointing an iframe to an external URL to make a cookied request and probably get the response ...
- 3,293
1
vote
2
answers
924
views
Why WebSockets doesn't apply SOP?
I can't understand why SOP (same-origin policy) cannot block Cross-Origin WebSocket Hijacking, I just read this article and I can't understand from where WebSocket requests comes from.
From where does ...
user226295
5
votes
2
answers
5k
views
What is the connection between CORS and SameSite cookie attribute?
For most of them may be its a silly question but I want it to know this in very simple language.
If an application is not using CORS at all then should we put this SameSite cookie attribute?
and if ...
- 89
0
votes
1
answer
2k
views
How to bypass origin based csrf protection?
I'm trying to do some csrf attack test on a site.
I found that the site protect itself from csrf by checking the http Origin header.
But I guess maybe under some conditions I can bypass the ...
- 11
2
votes
1
answer
769
views
Ideas for subdomains isolation
Consider a blogging platform - example.com and we want to host untrusted content in subdomain1.example.com and subdomain2.example.com.
By default, same origin policy doesn't allow communication ...
- 21
1
vote
2
answers
481
views
With the existence of CORS, what further purpose does same origin policy serve?
I've been using CORS for a while and I think I understand it. But as far as I can tell, because the allow-origin header is provided by the server being called, which an attacker can control as they ...
- 181
2
votes
1
answer
2k
views
Doesn't Samesite cookie and Sameorigin policy effectively does the same job?
Pardon me if I am wrong, however, I am looking for an answer for my understanding that isn't the concerns regarding CSRF solved by both Samesite cookie and Same-Origin-Policy effectively? Then why is ...
- 48
0
votes
0
answers
43
views
DOM access between same-origin tabs [duplicate]
Consider the following website. Page A (https://example.com/login) contains a login form and its password field has the attributes name and id set to "password". Page B (https://example.com/vuln) has ...
- 1
0
votes
2
answers
283
views
Why not sandbox websites instead of using Same-Origin-Policy?
Why do Browsers implement a Same-Origin-Policy (SOP) to prevent open websites in the browser from executing scripts that may access / modify data of other open websites in the used browser?
Another ...
- 131
4
votes
1
answer
5k
views
"Same origin policy" and XSS
I understand SOP, 'Same origin policy' is supposed to prevent script code with origin x from accessing data with origin y. Origin is said to be a tuple of protocol, domain and port.
This explains ...
- 143
6
votes
1
answer
330
views
Why was the Same-origin policy originally introduced (before XMLHttpRequest)?
As I understand it, the Same-origin policy (SOP) basically prevents a script in a web page from obtaining or sending information from/to a different domain.
I understand that this is important to ...
- 1,643
1
vote
0
answers
386
views
Do best practices eliminate the need for a CSRF token when writing an API server?
I realize that OWASP recommends CSRF tokens but I rarely see them used with public standalone HTTP APIs. This would seem to indicate that they're not always necessary.
To make this a little more ...
- 111
1
vote
1
answer
791
views
Same origin policy for CSRF attack?
Per mine understanding, by default same origin policy(SOP) is enabled by default by all browsers. This means that a web browser permits scripts contained in a first web page to access data in a ...
- 113
43
votes
7
answers
6k
views
Will the same JavaScript fetched by HTTP and HTTPS be cached separately by the browser?
Say that a web server supports both HTTP and HTTPS. If a browser fetches the same JavaScript with a HTTP GET and a HTTPS GET, and the JavaScript is cache-able, will the browser cache two copies of the ...
- 695
1
vote
2
answers
9k
views
Why is it not possible to spoof referer and origin header with XHR?
Technically speaking, it is possible to spoof both headers using an intercepting proxy but that's useless because we are doing it ourselves as an attacker.
When we send an ajax request using JS from ...
- 11
0
votes
1
answer
154
views
Remote extraction of passwords from browser password managers
I'm writing an essay about "Browser Password Managers". As part of this I have to write about vulnerabilities and exploits. I stumbled across the following scientific paper from 2013: "Password ...
- 1
0
votes
2
answers
243
views
Can JavaScript from different origins communicate securely
I want to know if there is a way for JS from one Origin to delegate a task to JS from another origin in a secure way.
The use case is to have a JS Agent from the users' home origin use the ...
- 455
1
vote
1
answer
372
views
Who can access the X-CSRF token?
I'm really confused about a CSRF token implementation in a Spring web app that I've inherited.
Basically, everyone can request the token by looking at what Spring Security filters do:
http
...
- 13
1
vote
1
answer
499
views
Difficulty understanding SOP and CSRF
As said here, a CSRF attack has little to do with SOP. However, on the OWASP CSRF page it is said that
Fortunately, this request will not be executed by modern web browsers thanks to same-origin ...
4
votes
1
answer
1k
views
Why are web font resource requests not no-cors?
CSS, JS, images etc are all fetched as no-cors. What's different about web fonts?
Per the spec:
For font loads, user agents must use the potentially CORS-enabled fetch method defined by the [FETCH]...
- 363
1
vote
2
answers
378
views
Are subdomains secure from one another if they are on separate servers?
I'm writing an application (example.com) that gives users their own sub-domains to run arbitrary user applications off of (user.example.com).
Each user application will be run on separate servers ...
- 111
1
vote
1
answer
212
views
How can the Same Origin Policy protect the user in times of CORS headers?
How can the Same origin policy protect something if you can bypass it via Cross Origin Resource Sharing headers? And why are those assigned by the server which is tried to access and not by the user?
...
- 113
0
votes
2
answers
2k
views
CORS Anywhere to bypass CSRF protection
CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers.
Can CORS Anywhere be used to bypass CSRF protection?
Reason to ask ...
- 11
0
votes
1
answer
778
views
DNS Spoofing Detection with JavaScript
I've came across an interesting question today - how can a JavaScript detect that a DNS Spoofing attack has been made against the client its running upon?
Scenario:
Edit: wrong scenario was ...
- 101
0
votes
1
answer
105
views
Custom JavaScript injection allowed in DOM of other origins [closed]
I am performing a security research on a development framework for thick client & mobile applications. The framework allows developers to inject custom JavaScript in the DOM of any origin.
This ...
- 149
2
votes
3
answers
1k
views
How can the Cookie-to-header-token CSRF protection technique be thwarted by permissive CORS origin header?
According to https://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-header_token
The protection provided by this technique can be thwarted if the
target website disables its same-...
- 891
1
vote
1
answer
2k
views
How can I securely disable CSRF validation for native clients when browser clients access the same API?
I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients.
How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls?
...
- 50.7k
0
votes
1
answer
380
views
Prevent javascript cross-origin write
Let's assume an attacker manages to inject this script in a login page:
const form = document.getElementsByTagName('form')[0];
form.addEventListener('submit', stealCredentials);
function ...
- 222
3
votes
1
answer
501
views
Why does not Referer header use “same-origin” by default?
Same origin policy is an important part of the security model so it is "on" by default for most things, but for the referer it does not seem to be so. The default for browsers seem to be no-referrer-...
- 2,267