Questions tagged [same-origin-policy]

The same-origin-policy is one of several models that web browsers use to determine which JavaScript files in a webpage should be executed. This is determined by the domain (the origin).

Filter by
Sorted by
Tagged with
2
votes
2answers
843 views

CSRF testing of an api endpoint using GET requests

I have an api endpoint that returns a new api token in JSON to the user if they're logged in to my website with only their session cookies being used to authenticate. I'm trying to write a piece of ...
5
votes
0answers
2k views

Is Cross Site History Manipulation (XSHM) still relevant?

XSHM is a vulnerability which exploits the fact that the browser history object does not follow the Same Origin Policy and hence by tracking the changes made to this object we may be able to track a ...
5
votes
1answer
296 views

Are restrictive same origin policies necessary?

The question is for the security community to resolve some misunderstandings here. The crux: Company (Wire) has a client (official-client.com) and a server code (e.g. official-server.com ). CORS ...
11
votes
1answer
1k views

Why is a "tainted canvas" a risk?

I understand the concern about a tainted canvas - the idea that the bits of an image from another site can be sent back to a malicious server. But can you explain the details of how exactly this works?...
0
votes
1answer
70 views

Can Origin headers be sent with get variables or the whole url?

An application I'm working on responds to a wildcard Origin header by setting the Access-Control-Allow-Origin to subdomain.app.com if ending with .app.com. However, if I append .app.com to a GET ...
3
votes
2answers
4k views

Is it safe to set "Access Control Allow Origin" header's value to the "Origin" header's value which is implicitly set by the browser?

I was testing a website and noticed that changing the "Origin" Header's value of a request with an intercepting proxy application results in the web application sending a response with "Access Control ...
0
votes
2answers
402 views

Same origin policy pentesting?

As we all know that what is the SOP? As its very popular. But my question arises when, pentesting this functionality. AS SOP provide the website to call the resources only from its domain. Ex. http: /...
1
vote
2answers
3k views

Is a single page application naturally breaking the same-origin policy?

Assume that you have a web application. The backend API is deployed at api.example.com and your frontend SPA is deployed at frontend.example.com. When you open it you download all the resources to ...
0
votes
1answer
1k views

GitHub pages and same origin

I am working with the security team at my work to get a website accredited before I can publish it...It is a very simple webpage hosted on Github pages with only some javascript. I kind of reached a ...
2
votes
1answer
8k views

Using data URIs to perform XSS in anchor tags - vulnerability? [duplicate]

I've been looking at a few issues related to XSS. In doing so, I've stumbled upon a few "XSS Filter Evasion" type checklists that demonstrate supposed XSS via data URIs. For example: The last line of:...
1
vote
1answer
220 views

what prevents sending "$.post" from one domain to another?

I have one website in chromium tab, and an other website in another tab, Im executing single post command in the second website - $.post(...); to the first website. Originaly its not working (getting: ...
1
vote
1answer
1k views

Crossdomain.xml - write access to domain

Is a permissive crossdomain.xml Flash policy analogous to a permissive CORS policy? i.e. Is <cross-domain-policy> <allow-access-from domain="*" /> </cross-domain-policy> the ...
1
vote
2answers
1k views

CSRF not working over CORS proxy

I'm consuming OData services from JQuery and running into a typical scenario of Same Origin Policy. I do not have control over the server and therefore I can not implement CORS so the only thing I can ...
0
votes
2answers
463 views

Setting Access-Control-Allow-Origin: * when session identifiers are injected in the HTTP headers

Is it considered as secure for an application to set a header access-control-allow-origin: * if during the normal usage of the application, the client credentials are injected in the headers by the JS ...
14
votes
3answers
14k views

How does CSRF correlate with Same Origin Policy

I'm trying to understand what roles do CSRF and same origin play in the grand scheme of things. With CSRF, I'm able to pretty much do anything on other websites on clients by making requests.Same ...
0
votes
1answer
688 views

Same Origin Policy and CSRF-Tokens

If we trust browsers that they satisfy Same Origin Policy without bugs, would we still need CSRF-tokens? Assuming server doesn't have CORS enabled: As far as I know we are not allowed to do POST ...
18
votes
2answers
9k views

How is the lack of the "SameSite" cookie flag a risk?

Nowadays cookies can have HTTPOnly, Secure and SameSite flags. The purposes of HTTPOnly and Secure flags are pretty clear. But what does SameSite scripting prevent exactly and how? Additionally, how ...
4
votes
0answers
176 views

XSS security concerns from untrusted parent domains

There's lots of discussion about protecting content on example.com from user controlled content on subdomain.example.com (e.g. Github pages). What are the risks the other way around? If my content is ...
2
votes
1answer
583 views

What does Same-origin policy apply to?

Until now I though same-origin policy applied to AJAX requests using either fetch or xmlHttpRequest, but I just learned that media objects also use this policy. Are there other things that use the ...
1
vote
1answer
7k views

No Preflight Request is made during XHR cross-origin request

I made a XHR cross-origin request from a html file, hosted on a python Simple HTTP Server. var xhr = new XMLHttpRequest(); xhr.open("GET", "https://www.facebook.com/favicon.ico", true); xhr....
6
votes
2answers
3k views

How do I correctly use CORS with OpenID Connect?

There seems to be a number of questions on several blogs, Q&A sites, and comments that ask variants of the question: How do I correctly use CORS with OpenID Connect? The context of these ...
10
votes
2answers
2k views

What attacks are mitigated by requiring CORS for subresource integrity verification?

Can someone elaborate on the attacks alluded to in this paragraph from the W3C SubResource Integrity spec? In order to mitigate an attacker’s ability to read data cross-origin by brute-forcing ...
3
votes
0answers
1k views

In practice, are 3rd party cookies used in Authentication? If they are blocked, what is the UX?

I'm researching the authentication flow in the case that 3rd party cookies are used to authenticate to a website, and are blocked by policy, proxy, or browser settings. It's clear that CORS and ...
1
vote
2answers
851 views

Third-Party cookies and CSRF

Do 3rd party cookies open up the possibility of CSRF where it may not exist? I was looking at a blog post as well as an IETF draft on same-site cookies that make it seem like 3rd party cookies could ...
5
votes
1answer
221 views

Would 'zero-knowledge' requests be an secure extension of SOP/CORS?

As far as I understand, the Same Origin Policy exists to prevent authenticated requests from other origins. So when a bad guy builds an evil website which tries to hijack the active authentication of ...
9
votes
2answers
5k views

How did the Facebook Originull vulnerablity of Access-Control-Allow-Origin: null allow cross-origin access?

Recently, a vulnerability in Facebook's messenger app which allowed attacks to access a users private messages via cross-origin AJAX was patched and disclosed. Simple Bug allows Hackers to Read all ...
3
votes
1answer
2k views

When does the same-origin policy prevent a request from being sent?

I have been dealing with some confusions on the same-origin policy. Let's say my attack looks like this. On page at evil.com the attacker has put (jQuery): $.post('http://bank.com/transfer', { to: '...
9
votes
1answer
7k views

Security about window.opener and iframes

I have 3 domains : domainA domainB domainC If I set target="_blank" on domainA with a link to domainC, domainC can access a bunch of property of domainA. That's why I use target="_blank" rel="...
-1
votes
1answer
235 views

Applicability of Same Origin Policy (SOP) when IP address is remapped via NAT

When an inbound/outbound TCP/IP traffic is faced with NAT address mapping, it's perfectly possible to have a different IP address as your request origin every few minutes. This is how most of the ...
2
votes
1answer
182 views

Is it a security risk that browsers can freely get images (and/or other resources) cross-domain?

Same origin policy protects us from malicious site manipulating the data on our trusted site by not allowing requests that would send the auth cookie e.g. But if I understand correctly images, scripts,...
1
vote
1answer
371 views

Instead of JSONP, why can't we bypass Same Origin Policy explicitly?

I've been learning about the Same Origin Policy. If you just want to access public JSON content, you have to use a workaround, such as CORS, reverse-proxy, and JSONP. If there were a way in ...
3
votes
3answers
580 views

How does the same origin policy apply to two different windows of a browser?

One particular scenario I am interested in: If I a open one chrome browser window with --disable-web-security option, then SOP is disabled. Will this window be able to access data on websites opened ...
-2
votes
1answer
3k views

is there any way to get the cookie from another tab or iframe's parent in browsers?

i was given a task to find a working way to bypass windows and android browsers same origin policy to be able to get the cookie of an open Tab in victim's browser (like Gmail or ... cookie). but as ...
3
votes
2answers
616 views

Does displaying images on profiles by URL have security implications?

I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic ...
5
votes
3answers
3k views

What purpose does Access-Control-Allow-Origin have?

I have a misunderstanding regarding CORS' Access-Control-Allow-Origin header. It's name says "allow" from which I understand that if I make a request from an "Origin" that is not allowed the request ...
5
votes
1answer
706 views

How does the same-origin-policy protect against PUT/DELETE CSRF?

I've read the OWASP guide for cross-site request forgery and it states that "other HTTP methods", such as PUT and DELETE could be theoretically used for CSRF. However with the same-origin-policy ...
5
votes
2answers
1k views

Is same origin policy for web only useful because of cookies?

There is a same origin policy in the browser to ensure that e.g. bad site won't read your data from Facebook. But it seems that the only problem that it tries to solve is that cookies are ...
8
votes
1answer
3k views

Alternative to anti-CSRF tokens for AJAX request (Same Origin Policy)

I'm working on a PHP website based entirely on AJAX (via jQuery). It's a single page in which all requests are made by AJAX. Related to the protection against CSRF I have encountered the problem of ...
0
votes
1answer
226 views

WebCrypto, SOP and Yubikeys

I've been following some discussions on WebApp Security mailing list regarding WebCrypto and SOP policies (100+ messages). One of the things that kind of sprang out was keys held in WebCrypto were not ...
1
vote
2answers
6k views

Implications of the security model of HTTP cookies on HTTPS connections

I have a feature that would require the user being able to provide the URL for a custom script, store the URL in a cookie, and incorporate the script into subsequent responses. This, of course, ...
1
vote
1answer
271 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
4
votes
4answers
2k views

about CSRF on form submit [duplicate]

I'm surely missing something in the picture of how CSRF attacks and protections are working. My understanding in a form-submit scenery is the protection rely on a unpredictable token, someway is ...
2
votes
0answers
194 views

Is there an iframe attack surface to webcache.googleusercontent.com?

I've noticed that one of my web-sites shows up pretty much blank when viewed from Google Cache at webcache.googleusercontent.com, because Google apparently must be inserting the following extra header,...
4
votes
1answer
110 views

Practical implications of 2014's android SOP vulnerability

For a project at university I have done research about all kinds of security issues, especially privacy-related ones, that have come up on mobile OS and applications over the last few years. One of ...
6
votes
3answers
2k views

Same Origin Policy - XHR response

I know that Same Origin Policy (SOP) prevents a page/script from one origin to read response from another origin, but it does not prevents the page/script from making a XMLHttpRequest (XHR) request to ...
2
votes
2answers
1k views

Can postMessage be used to forward data to hacker's iframe in CSRF attack?

Consider a user that has an open session to a legitimate site with a password on it. This page has no anti-CSRF token. A hacker creates a webpage with 2 hidden iframes. One iframe does a GET on the ...
3
votes
1answer
501 views

Uses of same origin policy

I am trying to understand what use cases exist for the use of Same Origin Policy (SOP). SOP prevents a document or script loaded from one origin to interact with a resource from another origin. But ...
3
votes
3answers
708 views

Understanding SOP in multiple tabs

I am reading another answer on this website. It says: Assume you are logged into Facebook and visit a malicious website in another browser tab. Without the same origin policy JavaScript on that ...
3
votes
1answer
2k views

How does the same-origin policy apply between browser tabs? [duplicate]

Let's assume that we have 2 open tabs in a browser containing page A (A.html, A.js) into the first tab and page B (B.html, B.js) into the second tab and that page A and B have the same origin (scheme, ...
6
votes
1answer
2k views

Why is a child window allowed to change the location of its parent?

Maybe a silly question. When opening a new tab via target="_blank", the page that loads in that tab is allowed to set a new location in the parent tab using: window.opener.location.replace('http://...