Questions tagged [same-origin-policy]

The same-origin-policy is one of several models that web browsers use to determine which JavaScript files in a webpage should be executed. This is determined by the domain (the origin).

10 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5 votes
0 answers

Is Cross Site History Manipulation (XSHM) still relevant?

XSHM is a vulnerability which exploits the fact that the browser history object does not follow the Same Origin Policy and hence by tracking the changes made to this object we may be able to track a ...
Shurmajee's user avatar
  • 7,417
5 votes
1 answer

XSS security concerns from untrusted parent domains

There's lots of discussion about protecting content on from user controlled content on (e.g. Github pages). What are the risks the other way around? If my content is ...
Tim Perry's user avatar
  • 181
4 votes
0 answers

Configure Access-Control-Allow-Origin for clients with origin: null

I develop a web app. When I run the app on Android, origin in the header of a network request is null. Access-Control-Allow-Origin in the response header is null too, because the origin of the ...
nightlyop's user avatar
  • 141
3 votes
0 answers

Cross-Origin-Opener-Policy: unsafe-none

A new HTTP header named Cross-Origin-Opener-Policy has three values: unsafe-none same-origin-allow-popups same-origin Google's article about this header explains its effects on other sites (...
rink.attendant.6's user avatar
3 votes
0 answers

What are the design considerations behind exempting WebSockets from the SOP?

I was rather surprised that in my experiments, I could simply connect from one website to a WebSocket server on a different domain/port pair. Subsequent research repeatedly showed that WebSockets do ...
Silly Freak's user avatar
3 votes
0 answers

In practice, are 3rd party cookies used in Authentication? If they are blocked, what is the UX?

I'm researching the authentication flow in the case that 3rd party cookies are used to authenticate to a website, and are blocked by policy, proxy, or browser settings. It's clear that CORS and ...
makerofthings7's user avatar
2 votes
1 answer

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL will automatically redirect the user (HTTP 302) to Is it possible for an attacker to steal the token, using javascript or flash, in ...
user avatar
2 votes
0 answers

Is there an iframe attack surface to

I've noticed that one of my web-sites shows up pretty much blank when viewed from Google Cache at, because Google apparently must be inserting the following extra header,...
cnst's user avatar
  • 1,924
1 vote
0 answers

What is meaning of setting port number to NULL in document.domain call?

Here ( it is mentioned The port number is checked separately by the browser. Any call to document.domain, including document....
positron's user avatar
  • 165
1 vote
0 answers

Do best practices eliminate the need for a CSRF token when writing an API server?

I realize that OWASP recommends CSRF tokens but I rarely see them used with public standalone HTTP APIs. This would seem to indicate that they're not always necessary. To make this a little more ...
Alan Plum's user avatar
  • 111