Questions tagged [same-origin-policy]
The same-origin-policy is one of several models that web browsers use to determine which JavaScript files in a webpage should be executed. This is determined by the domain (the origin).
151
questions
3
votes
1
answer
2k
views
Web-Application with CORS Origin: * using authorization header
As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote:
When responding to a credentialed request, the server must specify an
...
- 1,019
3
votes
1
answer
1k
views
Why is the same origin policy sensible - for requests?
This is not the same question as Why is the same origin policy so important?.
That one asks only about why cookies are only ever send to origin they came from, which I understand.
What I don't ...
- 139
8
votes
4
answers
6k
views
How come <img> calls do not violate the Same Origin Policy?
I'm a bit confused regarding the subject of Same Origin Policy (SOP). If I understand correctly, the purpose of the SOP is to prevent one page from obtaining access to sensitive data on another web ...
- 81
3
votes
0
answers
187
views
What are the design considerations behind exempting WebSockets from the SOP?
I was rather surprised that in my experiments, I could simply connect from one website to a WebSocket server on a different domain/port pair. Subsequent research repeatedly showed that WebSockets do ...
- 143
3
votes
1
answer
3k
views
Why are cross-domain POST requests allowed? [duplicate]
I understand that best practice is to use tokens to prevent CSRF, but why do browsers permit cross-site POST requests in the first place? It seems like giving untrusted parties unfettered write ...
- 137
1
vote
1
answer
2k
views
Is CORS and CSRF-tokens only for POST and GET requests? [closed]
I have the following questions regarding CSRF, SOP and CORS.
Does CSRF tokens only protect form submission with either POST or GET methods? Is this just a "common practice" (regarding the fact that ...
- 524
47
votes
3
answers
10k
views
Why don't browsers block cross-site POSTs by default?
Same-origin policy (SOP) makes browsers block scripting from one origin to mess with another, unless explicitly being told not to do so. But cross-site POSTs are still allowed, creating the vector for ...
- 585
0
votes
3
answers
800
views
Why can't bypass SOP using "src" attribut in script tag?
I'm not familiar with Javascript, but I want to know what can't be done in this steps in order to bypass SOP and extract sensitive data :
set the tag <script src="https://facebook.com/messages">...
- 367
4
votes
0
answers
5k
views
Configure Access-Control-Allow-Origin for clients with origin: null
I develop a web app. When I run the app on Android, origin in the header of a network request is null. Access-Control-Allow-Origin in the response header is null too, because the origin of the ...
- 141
2
votes
2
answers
1k
views
CSRF testing of an api endpoint using GET requests
I have an api endpoint that returns a new api token in JSON to the user if they're logged in to my website with only their session cookies being used to authenticate.
I'm trying to write a piece of ...
- 131
5
votes
0
answers
2k
views
Is Cross Site History Manipulation (XSHM) still relevant?
XSHM is a vulnerability which exploits the fact that the browser history object does not follow the Same Origin Policy and hence by tracking the changes made to this object we may be able to track a ...
- 7,417
5
votes
1
answer
372
views
Are restrictive same origin policies necessary?
The question is for the security community to resolve some misunderstandings here.
The crux:
Company (Wire) has a client (official-client.com) and a server code (e.g. official-server.com ).
CORS ...
- 53
11
votes
1
answer
1k
views
Why is a "tainted canvas" a risk?
I understand the concern about a tainted canvas - the idea that the bits of an image from another site can be sent back to a malicious server. But can you explain the details of how exactly this works?...
- 215
0
votes
1
answer
171
views
Can Origin headers be sent with get variables or the whole url?
An application I'm working on responds to a wildcard Origin header by setting the Access-Control-Allow-Origin to subdomain.app.com if ending with .app.com.
However, if I append .app.com to a GET ...
- 66
3
votes
2
answers
5k
views
Is it safe to set "Access Control Allow Origin" header's value to the "Origin" header's value which is implicitly set by the browser?
I was testing a website and noticed that changing the "Origin" Header's value of a request with an intercepting proxy application results in the web application sending a response with "Access Control ...
- 33
0
votes
2
answers
500
views
Same origin policy pentesting?
As we all know that what is the SOP? As its very popular. But my question arises when, pentesting this functionality.
AS SOP provide the website to call the resources only from its domain. Ex. http: /...
1
vote
2
answers
3k
views
Is a single page application naturally breaking the same-origin policy?
Assume that you have a web application. The backend API is deployed at api.example.com and your frontend SPA is deployed at frontend.example.com. When you open it you download all the resources to ...
- 101
0
votes
1
answer
2k
views
GitHub pages and same origin
I am working with the security team at my work to get a website accredited before I can publish it...It is a very simple webpage hosted on Github pages with only some javascript.
I kind of reached a ...
- 101
2
votes
1
answer
13k
views
Using data URIs to perform XSS in anchor tags - vulnerability? [duplicate]
I've been looking at a few issues related to XSS. In doing so, I've stumbled upon a few "XSS Filter Evasion" type checklists that demonstrate supposed XSS via data URIs. For example:
The last line of:...
- 131
1
vote
1
answer
364
views
what prevents sending "$.post" from one domain to another?
I have one website in chromium tab, and an other website in another tab,
Im executing single post command in the second website - $.post(...); to the first website.
Originaly its not working (getting: ...
- 33
1
vote
1
answer
1k
views
Crossdomain.xml - write access to domain
Is a permissive crossdomain.xml Flash policy analogous to a permissive CORS policy?
i.e. Is
<cross-domain-policy> <allow-access-from domain="*" /> </cross-domain-policy>
the ...
- 34k
1
vote
2
answers
2k
views
CSRF not working over CORS proxy
I'm consuming OData services from JQuery and running into a typical scenario of Same Origin Policy. I do not have control over the server and therefore I can not implement CORS so the only thing I can ...
- 61
0
votes
2
answers
506
views
Setting Access-Control-Allow-Origin: * when session identifiers are injected in the HTTP headers
Is it considered as secure for an application to set a header access-control-allow-origin: * if during the normal usage of the application, the client credentials are injected in the headers by the JS ...
- 217
17
votes
4
answers
23k
views
How does CSRF correlate with Same Origin Policy
I'm trying to understand what roles do CSRF and same origin play in the grand scheme of things. With CSRF, I'm able to pretty much do anything on other websites on clients by making requests.Same ...
- 179
0
votes
1
answer
965
views
Same Origin Policy and CSRF-Tokens
If we trust browsers that they satisfy Same Origin Policy without bugs, would we still need CSRF-tokens?
Assuming server doesn't have CORS enabled:
As far as I know we are not allowed to do POST ...
- 358
19
votes
2
answers
10k
views
How is the lack of the "SameSite" cookie flag a risk?
Nowadays cookies can have HTTPOnly, Secure and SameSite flags. The purposes of HTTPOnly and Secure flags are pretty clear. But what does SameSite scripting prevent exactly and how?
Additionally, how ...
- 6,661
5
votes
1
answer
267
views
XSS security concerns from untrusted parent domains
There's lots of discussion about protecting content on example.com from user controlled content on subdomain.example.com (e.g. Github pages). What are the risks the other way around?
If my content is ...
- 181
2
votes
1
answer
908
views
What does Same-origin policy apply to?
Until now I though same-origin policy applied to AJAX requests using either fetch or xmlHttpRequest, but I just learned that media objects also use this policy.
Are there other things that use the ...
- 231
1
vote
1
answer
8k
views
No Preflight Request is made during XHR cross-origin request
I made a XHR cross-origin request from a html file, hosted on a python Simple HTTP Server.
var xhr = new XMLHttpRequest();
xhr.open("GET", "https://www.facebook.com/favicon.ico", true);
xhr....
- 79
7
votes
2
answers
5k
views
How do I correctly use CORS with OpenID Connect?
There seems to be a number of questions on several blogs, Q&A sites, and comments that ask variants of the question:
How do I correctly use CORS with OpenID Connect?
The context of these ...
- 50.7k
12
votes
3
answers
3k
views
What attacks are mitigated by requiring CORS for subresource integrity verification?
Can someone elaborate on the attacks alluded to in this paragraph from the W3C SubResource Integrity spec?
In order to mitigate an attacker’s ability to read data cross-origin by brute-forcing ...
- 433
3
votes
0
answers
1k
views
In practice, are 3rd party cookies used in Authentication? If they are blocked, what is the UX?
I'm researching the authentication flow in the case that 3rd party cookies are used to authenticate to a website, and are blocked by policy, proxy, or browser settings.
It's clear that CORS and ...
- 50.7k
1
vote
2
answers
1k
views
Third-Party cookies and CSRF
Do 3rd party cookies open up the possibility of CSRF where it may not exist? I was looking at a blog post as well as an IETF draft on same-site cookies that make it seem like 3rd party cookies could ...
- 553
5
votes
1
answer
270
views
Would 'zero-knowledge' requests be an secure extension of SOP/CORS?
As far as I understand, the Same Origin Policy exists to prevent authenticated requests from other origins.
So when a bad guy builds an evil website which tries to hijack the active authentication of ...
- 151
9
votes
2
answers
5k
views
How did the Facebook Originull vulnerablity of Access-Control-Allow-Origin: null allow cross-origin access?
Recently, a vulnerability in Facebook's messenger app which allowed attacks to access a users private messages via cross-origin AJAX was patched and disclosed.
Simple Bug allows Hackers to Read all ...
- 8,834
5
votes
1
answer
3k
views
When does the same-origin policy prevent a request from being sent?
I have been dealing with some confusions on the same-origin policy.
Let's say my attack looks like this. On page at evil.com the attacker has put (jQuery):
$.post('http://bank.com/transfer', { to: '...
- 161
9
votes
1
answer
8k
views
Security about window.opener and iframes
I have 3 domains : domainA domainB domainC
If I set target="_blank" on domainA with a link to domainC, domainC can access a bunch of property of domainA. That's why I use target="_blank" rel="...
- 2,914
-1
votes
1
answer
292
views
Applicability of Same Origin Policy (SOP) when IP address is remapped via NAT
When an inbound/outbound TCP/IP traffic is faced with NAT address mapping, it's perfectly possible to have a different IP address as your request origin every few minutes. This is how most of the ...
- 151
2
votes
1
answer
481
views
Is it a security risk that browsers can freely get images (and/or other resources) cross-domain?
Same origin policy protects us from malicious site manipulating the data on our trusted site by not allowing requests that would send the auth cookie e.g. But if I understand correctly images, scripts,...
- 2,267
1
vote
1
answer
431
views
Instead of JSONP, why can't we bypass Same Origin Policy explicitly?
I've been learning about the Same Origin Policy. If you just want to access public JSON content, you have to use a workaround, such as CORS, reverse-proxy, and JSONP.
If there were a way in ...
- 111
3
votes
3
answers
648
views
How does the same origin policy apply to two different windows of a browser?
One particular scenario I am interested in: If I a open one chrome browser window with --disable-web-security option, then SOP is disabled. Will this window be able to access data on websites opened ...
- 372
-2
votes
1
answer
4k
views
is there any way to get the cookie from another tab or iframe's parent in browsers?
i was given a task to find a working way to bypass windows and android browsers same origin policy to be able to get the cookie of an open Tab in victim's browser (like Gmail or ... cookie).
but as ...
user106957
3
votes
2
answers
1k
views
Does displaying images on profiles by URL have security implications?
I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic ...
- 464
5
votes
3
answers
3k
views
What purpose does Access-Control-Allow-Origin have?
I have a misunderstanding regarding CORS' Access-Control-Allow-Origin header.
It's name says "allow" from which I understand that if I make a request from an "Origin" that is not allowed the request ...
- 53
5
votes
1
answer
834
views
How does the same-origin-policy protect against PUT/DELETE CSRF?
I've read the OWASP guide for cross-site request forgery and it states that "other HTTP methods", such as PUT and DELETE could be theoretically used for CSRF.
However with the same-origin-policy ...
- 265
5
votes
2
answers
2k
views
Is same origin policy for web only useful because of cookies?
There is a same origin policy in the browser to ensure that e.g. bad site won't read your data from Facebook. But it seems that the only problem that it tries to solve is that cookies are ...
- 2,267
8
votes
1
answer
3k
views
Alternative to anti-CSRF tokens for AJAX request (Same Origin Policy)
I'm working on a PHP website based entirely on AJAX (via jQuery). It's a single page in which all requests are made by AJAX.
Related to the protection against CSRF I have encountered the problem of ...
- 183
0
votes
1
answer
348
views
WebCrypto, SOP and Yubikeys
I've been following some discussions on WebApp Security mailing list regarding WebCrypto and SOP policies (100+ messages). One of the things that kind of sprang out was keys held in WebCrypto were not ...
user29925
1
vote
2
answers
6k
views
Implications of the security model of HTTP cookies on HTTPS connections
I have a feature that would require the user being able to provide the URL for a custom script, store the URL in a cookie, and incorporate the script into subsequent responses.
This, of course, ...
- 133
2
votes
1
answer
361
views
Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?
The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE.
Is it possible for an attacker to steal the token, using javascript or flash, in ...
user61429