Questions tagged [same-origin-policy]
The same-origin-policy is one of several models that web browsers use to determine which JavaScript files in a webpage should be executed. This is determined by the domain (the origin).
151
questions
4
votes
4
answers
3k
views
about CSRF on form submit [duplicate]
I'm surely missing something in the picture of how CSRF attacks and protections are working.
My understanding in a form-submit scenery is the protection rely on a unpredictable token, someway is ...
- 151
2
votes
0
answers
253
views
Is there an iframe attack surface to webcache.googleusercontent.com?
I've noticed that one of my web-sites shows up pretty much blank when viewed from Google Cache at webcache.googleusercontent.com, because Google apparently must be inserting the following extra header,...
- 1,924
4
votes
1
answer
165
views
Practical implications of 2014's android SOP vulnerability
For a project at university I have done research about all kinds of security issues, especially privacy-related ones, that have come up on mobile OS and applications over the last few years.
One of ...
- 1,233
6
votes
3
answers
2k
views
Same Origin Policy - XHR response
I know that Same Origin Policy (SOP) prevents a page/script from one origin to read response from another origin, but it does not prevents the page/script from making a XMLHttpRequest (XHR) request to ...
2
votes
2
answers
1k
views
Can postMessage be used to forward data to hacker's iframe in CSRF attack?
Consider a user that has an open session to a legitimate site with a password on it. This page has no anti-CSRF token.
A hacker creates a webpage with 2 hidden iframes. One iframe does a GET on the ...
- 121
3
votes
1
answer
575
views
Uses of same origin policy
I am trying to understand what use cases exist for the use of Same Origin Policy (SOP).
SOP prevents a document or script loaded from one origin to interact with a resource from another origin.
But ...
- 1,095
3
votes
3
answers
831
views
Understanding SOP in multiple tabs
I am reading another answer on this website.
It says:
Assume you are logged into Facebook and visit a malicious website in
another browser tab. Without the same origin policy JavaScript on that
...
- 1,095
3
votes
1
answer
2k
views
How does the same-origin policy apply between browser tabs? [duplicate]
Let's assume that we have 2 open tabs in a browser containing page A (A.html, A.js) into the first tab and page B (B.html, B.js) into the second tab and that page A and B have the same origin (scheme, ...
- 439
6
votes
1
answer
2k
views
Why is a child window allowed to change the location of its parent?
Maybe a silly question. When opening a new tab via target="_blank", the page that loads in that tab is allowed to set a new location in the parent tab using:
window.opener.location.replace('http://...
- 345
3
votes
3
answers
4k
views
How is the same origin policy causing my PoC to fail when I don't need to read return data?
I'm performing an authorized vulnerability analysis on a custom web service and have discovered a CSRF vulnerability.
Due to there not being form tokens coupled with the service not checking for the ...
- 133
60
votes
2
answers
96k
views
Why do browsers enforce the same-origin security policy on iframes?
I did a small test on Chrome (V37) today. I created a small page and loaded it to the browser:
<!DOCTYPE html>
<html>
<head>
<title>Untitled Document</title>
</...
- 805
8
votes
4
answers
802
views
Same-origin policy for desktop application?
The same-origin policy is one of the most important security feature in our browser.
It basically provides sandboxing for our applications which is protecting our users.
Desktop application can read ...
- 6,981
7
votes
1
answer
2k
views
Why CSRF's JS can't read token by GETting html
1) User is logged in bank.com in one tab, where everything is secured by CSRF tokens. Then he opens evil.com in another tab.
2) Javascript in evil.com might try to make a POST request to bank.com/...
- 419
3
votes
1
answer
3k
views
Understanding Same origin policy
I am trying to understand same origin policy better. From what I understand same origin policy restricts code from one "origin" not access data from another "origin". What I am trying to understand is ...
- 903
1
vote
1
answer
2k
views
CSRF Token Stealing
I came across this link that dicusses how an attacker could exploit access control allow origin to get an anti-CSRF token:
http://yossi-yakubov.blogspot.com/2011/09/bypassing-token-protection-against-...
- 201
16
votes
1
answer
6k
views
How are Ajax requests vulnerable to CSRF attacks if the Same-origin policy is applied?
What I know about CSRF is that a malicious website tricks a normal user into issuing a request to a trusted website using a form.
I understand that is possible because we can post forms to different ...
- 261
6
votes
1
answer
2k
views
SSO via HMAC and shared key. Can this be improved?
Given an authenticated user on A.com, we want to redirect the user to B.com so that she'll be immedaitely authenticated. The scheme I'm considering is very basic:
A.com and B.com both share key S.
...
- 205
3
votes
1
answer
1k
views
In Same Origin Policy, why are different protocols considered a security violation?
I can understand why content from different domains is considered to be unstrusted for the same origin policy. But, how can be content from diferent protocols from the same site/domain be dangerous?
...
- 213
3
votes
1
answer
2k
views
Access-Control-Allow-Origin wihout AJAX
This answer (incorrectly?) states
No, as long as the CORS Access-Control-Allow-Origin is at its default restrictive value. This prevents the outer website from accessing the framed website via ...
- 34k
6
votes
1
answer
2k
views
Does returning Access-Control-Allow-Origin: * weaken the security of JSON GET responses?
The W3C CORS recommendation states:
Certain types of resources should not attempt to specify
particular authorized origins, but instead either deny or allow
all origins.
...
3. A GET ...
- 161
56
votes
2
answers
88k
views
Why is the Access-Control-Allow-Origin header necessary?
I understand the purpose of the Access-Control-Allow-Credentials header, but can't see what problem the Access-Control-Allow-Origin header solves.
More precisely, it's easy to see how, if cross-...
- 1,817
1
vote
2
answers
852
views
Can older or custom web browsers override the same origin policy?
I totally understand the basis of origin policy and the reasoning why all modern browsers have put this policy into place.
My question I guess is, do older browsers support this, and if they don't, ...
- 113
1
vote
1
answer
3k
views
ReverseProxy and PCI Compliance
My company has a PCI compliant billing gateway and they expose a service for submitting credit card payment details.
I am writing a (Single Page Application/end-to-end javascript) website for them ...
- 155
4
votes
3
answers
2k
views
Flash ignores Content-Type header, allowing XSS?
I recently read that the Flash plugin ignores the Content-Type header in certain circumstances. In particular, you can give Flash a URL, and the Flash plugin will happily fetch the content at that ...
- 99.4k
4
votes
2
answers
445
views
Securely render SVG
How can I securely render SVG documents in a media sharing application?
I think the same-origin policy might help a bit if I host the SVG documents on a separate domain and render them inside an <...
- 495
1
vote
1
answer
185
views
Gaining sensible information from advertisement displayed in web pages
As we all know, JavaScript loaded inside a website A gets restricted to access the domain itself [same origin policy].
Unfortunately, same origin policy does not apply to newly created DOM nodes, ...
- 315
8
votes
1
answer
2k
views
Child iFrame hash verification of parent iFrame content
Consider the following scenario:
Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not ...
- 862
3
votes
1
answer
1k
views
Why is Access-Control-Allow-Origin required for uncredentialed cross-domain requests? [duplicate]
I understand CSRF and why cross-domain AJAX requests with cookies or other credentials can't be permitted without an Access-Control-Allow-Credentials header explicitly permitting them - otherwise I'd ...
- 1,817
2
votes
4
answers
308
views
New gTLDs are coming. How will browsers handle cookies, SOP and certificates?
Given that the security "zone" varies based on the TLD, how will the new TLS be handled?
For example: A browser may permit cookies to be shared and SSL certificates, and wildcard certificates
...
- 50.7k
4
votes
1
answer
7k
views
In which ways could a javascript making a cross domain HEAD request be a threat?
I was just reading this answer to the question Why is the same origin policy so important?
Basically, when you try to make an XMLHttpRequest to a different
domain, the browser will do one of two ...
- 1,302
8
votes
2
answers
2k
views
Best practices for integrating external javascript?
I'm looking for some standard pieces of advice on how to integrate external JavaScript into a website. For example, on mywebsite.com:
<script src='//externalsite.com/js/script.js'></script&...
- 181
2
votes
1
answer
4k
views
What is the "about:blank" context for browser security and privacy?
This blog is describing a way to hide the referer header in various situations. Specifically he is referring to things that run in the about:blank context.
What is the about:blank context?
How does ...
- 50.7k
2
votes
2
answers
3k
views
How do browsers know which cookie to get?
I tried writing a script that would display the contents of a cookie set by another website but it didn't work.
<?php
echo 'Website cookie is '.$_COOKIE['locale'];
?>
But I get an undefined ...
- 10.1k
0
votes
1
answer
274
views
How does DOCTYPE selection affect security of my AJAX app?
I'm considering using modern techniques to protect my Javascript code and am studying how the DOCTYPE element selection may impact that. Specifically, the linked question used IFrames which are not ...
- 50.7k
4
votes
2
answers
441
views
Defense against same origin attacks?
The Question:
How do I, as the victim, protect my site from being manipulated into doing something it's not supposed to, on a shared host? Same-Origin policy looks the other way. Most convenient ...
- 143
14
votes
1
answer
3k
views
How can I embed iframe securely without restricting its functionality?
I'd want to embed an iframe from untrusted site into web application. Iframe:
should be able to run Javascript and browser plugins (Flash, etc.)
should not be able to access my web application ...
- 5,357
7
votes
1
answer
3k
views
Same-origin policy for file: URLs in Android browser?
When you load a file:// URL in an Android WebView or in the Android browser, what does it treat as the origin? What can the Javascript on that page access? Can it access other files in the same ...
- 99.4k
11
votes
2
answers
2k
views
User-specific Subdomains : JavaScript security
If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
Brandon
9
votes
3
answers
490
views
E-mail read receipt through XSS
I recently stumbled upon a really silly/unsafe but an interesting way to get a read receipt of an e-mail. I'm not 100% sure if the method in use works, which is why I'm asking it here.
G-mail does ...
- 4,320
3
votes
1
answer
261
views
Vulnerabilities of having one path of app accessible only via HTTPS but others via HTTP?
Imagine example.com that is accessible via HTTP and HTTPS. Most of content at site isn't secure and it won't be bad if it will be read by attacker. One of paths - example.com/secure_zone is accessible ...
- 5,357
2
votes
3
answers
3k
views
Why can I read the response to this CSRF attack?
I have a website www.foo.com:8002 that I have resolve to 127.0.0.1:8002 in my hosts file. I have another (the main site) running at localhost:80
In www.foo.com:8002 the page looks like
<form name=...
- 557
4
votes
1
answer
700
views
Client-side cross-site access in SSL environment - when it's still possible to do?
I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...
- 171
17
votes
3
answers
13k
views
Do browsers allows pages loaded on one tab to access/intercept/inject data in other tabs?
I was surprised to hear from this Reuters video that it was possible for a page loaded on one tab to access and/or inject data onto another page loaded on a different tab.
TL;DW (too lazy; didn't ...
- 173
10
votes
3
answers
10k
views
Why doesn't the same origin policy block get requests that contain arguments?
From what I understand, the same origin policy prevents scripts in a web page from talking to servers outside of the present domain (using post, xmlhttprequest, etc). I assumed that get requests (...
- 211
19
votes
2
answers
9k
views
Using iframes to sandbox untrusted code
I'm trying to create an extensible platform, where my site will provide a model and some views (both client-side, in the browser) and third party sites may add their own views as well. The goal here ...
- 2,925
21
votes
3
answers
6k
views
What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?
I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue.
Since JSONP bypasses same-...
- 311
3
votes
1
answer
419
views
What servers or clients are immune to related-domain cookie attacks? (*.example.com)
In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com).
Lacking any tangible solution, ...
- 50.7k
15
votes
1
answer
21k
views
cookie path protection within same domain
The answer to this question about how cookies are potentially vulnerable between sub-domains sparked my curiosity.
As far as I know, if a cookie is set on a sub-path of the same domain (www.example....
- 5,349
2
votes
1
answer
992
views
Active Directory: Should Workstations be separated from servers to protect from related domain hacks?
How should I protect domain joined hosts in the same AD domain from the Related Domain Cookie Attack?
Suppose there is an AD forest called example.com. This company has a variety of internal and ...
- 50.7k
3
votes
3
answers
600
views
Are there any same origin issues (SOP) with TOR?
Are there any issues with Same Origin Policy (SOP) with TOR or *.onion addresses?
I'm thinking of
cookies
Plugins (Silverlight, Flash, Java, etc)
Javascript
- 50.7k