Questions tagged [same-origin-policy]
The same-origin-policy is one of several models that web browsers use to determine which JavaScript files in a webpage should be executed. This is determined by the domain (the origin).
10
questions with no upvoted or accepted answers
5
votes
0
answers
2k
views
Is Cross Site History Manipulation (XSHM) still relevant?
XSHM is a vulnerability which exploits the fact that the browser history object does not follow the Same Origin Policy and hence by tracking the changes made to this object we may be able to track a ...
- 7,417
5
votes
1
answer
267
views
XSS security concerns from untrusted parent domains
There's lots of discussion about protecting content on example.com from user controlled content on subdomain.example.com (e.g. Github pages). What are the risks the other way around?
If my content is ...
- 181
4
votes
0
answers
5k
views
Configure Access-Control-Allow-Origin for clients with origin: null
I develop a web app. When I run the app on Android, origin in the header of a network request is null. Access-Control-Allow-Origin in the response header is null too, because the origin of the ...
- 141
3
votes
0
answers
249
views
Cross-Origin-Opener-Policy: unsafe-none
A new HTTP header named Cross-Origin-Opener-Policy has three values:
unsafe-none
same-origin-allow-popups
same-origin
Google's web.dev article about this header explains its effects on other sites (...
- 2,257
3
votes
0
answers
187
views
What are the design considerations behind exempting WebSockets from the SOP?
I was rather surprised that in my experiments, I could simply connect from one website to a WebSocket server on a different domain/port pair. Subsequent research repeatedly showed that WebSockets do ...
- 143
3
votes
0
answers
1k
views
In practice, are 3rd party cookies used in Authentication? If they are blocked, what is the UX?
I'm researching the authentication flow in the case that 3rd party cookies are used to authenticate to a website, and are blocked by policy, proxy, or browser settings.
It's clear that CORS and ...
- 50.7k
2
votes
1
answer
361
views
Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?
The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE.
Is it possible for an attacker to steal the token, using javascript or flash, in ...
user61429
2
votes
0
answers
253
views
Is there an iframe attack surface to webcache.googleusercontent.com?
I've noticed that one of my web-sites shows up pretty much blank when viewed from Google Cache at webcache.googleusercontent.com, because Google apparently must be inserting the following extra header,...
- 1,924
1
vote
0
answers
404
views
What is meaning of setting port number to NULL in document.domain call?
Here (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it is mentioned
The port number is checked separately by the browser. Any call to document.domain, including document....
- 165
1
vote
0
answers
386
views
Do best practices eliminate the need for a CSRF token when writing an API server?
I realize that OWASP recommends CSRF tokens but I rarely see them used with public standalone HTTP APIs. This would seem to indicate that they're not always necessary.
To make this a little more ...
- 111