Questions tagged [same-origin-policy]
The same-origin-policy is one of several models that web browsers use to determine which JavaScript files in a webpage should be executed. This is determined by the domain (the origin).
151
questions
161
votes
4
answers
88k
views
Why is the same origin policy so important?
I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
- 2,259
60
votes
2
answers
96k
views
Why do browsers enforce the same-origin security policy on iframes?
I did a small test on Chrome (V37) today. I created a small page and loaded it to the browser:
<!DOCTYPE html>
<html>
<head>
<title>Untitled Document</title>
</...
- 805
56
votes
2
answers
88k
views
Why is the Access-Control-Allow-Origin header necessary?
I understand the purpose of the Access-Control-Allow-Credentials header, but can't see what problem the Access-Control-Allow-Origin header solves.
More precisely, it's easy to see how, if cross-...
- 1,817
47
votes
3
answers
10k
views
Why don't browsers block cross-site POSTs by default?
Same-origin policy (SOP) makes browsers block scripting from one origin to mess with another, unless explicitly being told not to do so. But cross-site POSTs are still allowed, creating the vector for ...
- 585
43
votes
7
answers
6k
views
Will the same JavaScript fetched by HTTP and HTTPS be cached separately by the browser?
Say that a web server supports both HTTP and HTTPS. If a browser fetches the same JavaScript with a HTTP GET and a HTTPS GET, and the JavaScript is cache-able, will the browser cache two copies of the ...
- 695
28
votes
7
answers
14k
views
How do hackers trick frontend validation?
I've always read: Put validations in the backend. Frontend validations are for UX, not security. This is because bad actors can trick frontend validation. But I'm having a hard time wrapping my head ...
21
votes
3
answers
6k
views
What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?
I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue.
Since JSONP bypasses same-...
- 311
19
votes
2
answers
10k
views
How is the lack of the "SameSite" cookie flag a risk?
Nowadays cookies can have HTTPOnly, Secure and SameSite flags. The purposes of HTTPOnly and Secure flags are pretty clear. But what does SameSite scripting prevent exactly and how?
Additionally, how ...
- 6,661
19
votes
2
answers
9k
views
Using iframes to sandbox untrusted code
I'm trying to create an extensible platform, where my site will provide a model and some views (both client-side, in the browser) and third party sites may add their own views as well. The goal here ...
- 2,925
17
votes
4
answers
23k
views
How does CSRF correlate with Same Origin Policy
I'm trying to understand what roles do CSRF and same origin play in the grand scheme of things. With CSRF, I'm able to pretty much do anything on other websites on clients by making requests.Same ...
- 179
17
votes
3
answers
13k
views
Do browsers allows pages loaded on one tab to access/intercept/inject data in other tabs?
I was surprised to hear from this Reuters video that it was possible for a page loaded on one tab to access and/or inject data onto another page loaded on a different tab.
TL;DW (too lazy; didn't ...
- 173
16
votes
1
answer
6k
views
How are Ajax requests vulnerable to CSRF attacks if the Same-origin policy is applied?
What I know about CSRF is that a malicious website tricks a normal user into issuing a request to a trusted website using a form.
I understand that is possible because we can post forms to different ...
- 261
15
votes
1
answer
21k
views
cookie path protection within same domain
The answer to this question about how cookies are potentially vulnerable between sub-domains sparked my curiosity.
As far as I know, if a cookie is set on a sub-path of the same domain (www.example....
- 5,349
14
votes
1
answer
3k
views
How can I embed iframe securely without restricting its functionality?
I'd want to embed an iframe from untrusted site into web application. Iframe:
should be able to run Javascript and browser plugins (Flash, etc.)
should not be able to access my web application ...
- 5,357
12
votes
3
answers
3k
views
What attacks are mitigated by requiring CORS for subresource integrity verification?
Can someone elaborate on the attacks alluded to in this paragraph from the W3C SubResource Integrity spec?
In order to mitigate an attacker’s ability to read data cross-origin by brute-forcing ...
- 433
11
votes
2
answers
2k
views
User-specific Subdomains : JavaScript security
If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
Brandon
11
votes
1
answer
1k
views
Why is a "tainted canvas" a risk?
I understand the concern about a tainted canvas - the idea that the bits of an image from another site can be sent back to a malicious server. But can you explain the details of how exactly this works?...
- 215
10
votes
3
answers
10k
views
Why doesn't the same origin policy block get requests that contain arguments?
From what I understand, the same origin policy prevents scripts in a web page from talking to servers outside of the present domain (using post, xmlhttprequest, etc). I assumed that get requests (...
- 211
9
votes
3
answers
490
views
E-mail read receipt through XSS
I recently stumbled upon a really silly/unsafe but an interesting way to get a read receipt of an e-mail. I'm not 100% sure if the method in use works, which is why I'm asking it here.
G-mail does ...
- 4,320
9
votes
2
answers
5k
views
How did the Facebook Originull vulnerablity of Access-Control-Allow-Origin: null allow cross-origin access?
Recently, a vulnerability in Facebook's messenger app which allowed attacks to access a users private messages via cross-origin AJAX was patched and disclosed.
Simple Bug allows Hackers to Read all ...
- 8,834
9
votes
1
answer
8k
views
Security about window.opener and iframes
I have 3 domains : domainA domainB domainC
If I set target="_blank" on domainA with a link to domainC, domainC can access a bunch of property of domainA. That's why I use target="_blank" rel="...
- 2,914
8
votes
4
answers
802
views
Same-origin policy for desktop application?
The same-origin policy is one of the most important security feature in our browser.
It basically provides sandboxing for our applications which is protecting our users.
Desktop application can read ...
- 6,981
8
votes
4
answers
5k
views
How come <img> calls do not violate the Same Origin Policy?
I'm a bit confused regarding the subject of Same Origin Policy (SOP). If I understand correctly, the purpose of the SOP is to prevent one page from obtaining access to sensitive data on another web ...
- 81
8
votes
2
answers
2k
views
Best practices for integrating external javascript?
I'm looking for some standard pieces of advice on how to integrate external JavaScript into a website. For example, on mywebsite.com:
<script src='//externalsite.com/js/script.js'></script&...
- 181
8
votes
1
answer
3k
views
Alternative to anti-CSRF tokens for AJAX request (Same Origin Policy)
I'm working on a PHP website based entirely on AJAX (via jQuery). It's a single page in which all requests are made by AJAX.
Related to the protection against CSRF I have encountered the problem of ...
- 183
8
votes
1
answer
2k
views
Child iFrame hash verification of parent iFrame content
Consider the following scenario:
Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not ...
- 862
7
votes
1
answer
2k
views
Why CSRF's JS can't read token by GETting html
1) User is logged in bank.com in one tab, where everything is secured by CSRF tokens. Then he opens evil.com in another tab.
2) Javascript in evil.com might try to make a POST request to bank.com/...
- 419
7
votes
1
answer
3k
views
Same-origin policy for file: URLs in Android browser?
When you load a file:// URL in an Android WebView or in the Android browser, what does it treat as the origin? What can the Javascript on that page access? Can it access other files in the same ...
- 99.5k
7
votes
2
answers
5k
views
How do I correctly use CORS with OpenID Connect?
There seems to be a number of questions on several blogs, Q&A sites, and comments that ask variants of the question:
How do I correctly use CORS with OpenID Connect?
The context of these ...
- 50.7k
6
votes
5
answers
6k
views
Why doesn't a simple HTTP request to display a remote web page violate the same-origin policy?
On a W3Schools page, I found that HTTP requests work like this:
A client (a browser) sends an HTTP request to the web
A web server receives the request, and runs an application to process it
The ...
- 81
6
votes
3
answers
2k
views
Same Origin Policy - XHR response
I know that Same Origin Policy (SOP) prevents a page/script from one origin to read response from another origin, but it does not prevents the page/script from making a XMLHttpRequest (XHR) request to ...
6
votes
1
answer
2k
views
SSO via HMAC and shared key. Can this be improved?
Given an authenticated user on A.com, we want to redirect the user to B.com so that she'll be immedaitely authenticated. The scheme I'm considering is very basic:
A.com and B.com both share key S.
...
- 205
6
votes
1
answer
2k
views
Why is a child window allowed to change the location of its parent?
Maybe a silly question. When opening a new tab via target="_blank", the page that loads in that tab is allowed to set a new location in the parent tab using:
window.opener.location.replace('http://...
- 345
6
votes
1
answer
330
views
Why was the Same-origin policy originally introduced (before XMLHttpRequest)?
As I understand it, the Same-origin policy (SOP) basically prevents a script in a web page from obtaining or sending information from/to a different domain.
I understand that this is important to ...
- 1,643
6
votes
1
answer
2k
views
Does returning Access-Control-Allow-Origin: * weaken the security of JSON GET responses?
The W3C CORS recommendation states:
Certain types of resources should not attempt to specify
particular authorized origins, but instead either deny or allow
all origins.
...
3. A GET ...
- 161
5
votes
1
answer
3k
views
When does the same-origin policy prevent a request from being sent?
I have been dealing with some confusions on the same-origin policy.
Let's say my attack looks like this. On page at evil.com the attacker has put (jQuery):
$.post('http://bank.com/transfer', { to: '...
- 161
5
votes
2
answers
2k
views
Is same origin policy for web only useful because of cookies?
There is a same origin policy in the browser to ensure that e.g. bad site won't read your data from Facebook. But it seems that the only problem that it tries to solve is that cookies are ...
- 2,267
5
votes
3
answers
3k
views
What purpose does Access-Control-Allow-Origin have?
I have a misunderstanding regarding CORS' Access-Control-Allow-Origin header.
It's name says "allow" from which I understand that if I make a request from an "Origin" that is not allowed the request ...
- 53
5
votes
2
answers
5k
views
What is the connection between CORS and SameSite cookie attribute?
For most of them may be its a silly question but I want it to know this in very simple language.
If an application is not using CORS at all then should we put this SameSite cookie attribute?
and if ...
- 89
5
votes
1
answer
834
views
How does the same-origin-policy protect against PUT/DELETE CSRF?
I've read the OWASP guide for cross-site request forgery and it states that "other HTTP methods", such as PUT and DELETE could be theoretically used for CSRF.
However with the same-origin-policy ...
- 265
5
votes
1
answer
371
views
Are restrictive same origin policies necessary?
The question is for the security community to resolve some misunderstandings here.
The crux:
Company (Wire) has a client (official-client.com) and a server code (e.g. official-server.com ).
CORS ...
- 53
5
votes
1
answer
270
views
Would 'zero-knowledge' requests be an secure extension of SOP/CORS?
As far as I understand, the Same Origin Policy exists to prevent authenticated requests from other origins.
So when a bad guy builds an evil website which tries to hijack the active authentication of ...
- 151
5
votes
0
answers
2k
views
Is Cross Site History Manipulation (XSHM) still relevant?
XSHM is a vulnerability which exploits the fact that the browser history object does not follow the Same Origin Policy and hence by tracking the changes made to this object we may be able to track a ...
- 7,417
5
votes
1
answer
267
views
XSS security concerns from untrusted parent domains
There's lots of discussion about protecting content on example.com from user controlled content on subdomain.example.com (e.g. Github pages). What are the risks the other way around?
If my content is ...
- 181
4
votes
4
answers
3k
views
about CSRF on form submit [duplicate]
I'm surely missing something in the picture of how CSRF attacks and protections are working.
My understanding in a form-submit scenery is the protection rely on a unpredictable token, someway is ...
- 151
4
votes
1
answer
5k
views
"Same origin policy" and XSS
I understand SOP, 'Same origin policy' is supposed to prevent script code with origin x from accessing data with origin y. Origin is said to be a tuple of protocol, domain and port.
This explains ...
- 143
4
votes
1
answer
1k
views
Why are web font resource requests not no-cors?
CSS, JS, images etc are all fetched as no-cors. What's different about web fonts?
Per the spec:
For font loads, user agents must use the potentially CORS-enabled fetch method defined by the [FETCH]...
- 363
4
votes
2
answers
441
views
Defense against same origin attacks?
The Question:
How do I, as the victim, protect my site from being manipulated into doing something it's not supposed to, on a shared host? Same-Origin policy looks the other way. Most convenient ...
- 143
4
votes
2
answers
445
views
Securely render SVG
How can I securely render SVG documents in a media sharing application?
I think the same-origin policy might help a bit if I host the SVG documents on a separate domain and render them inside an <...
- 495
4
votes
1
answer
7k
views
In which ways could a javascript making a cross domain HEAD request be a threat?
I was just reading this answer to the question Why is the same origin policy so important?
Basically, when you try to make an XMLHttpRequest to a different
domain, the browser will do one of two ...
- 1,302