Skip to main content
97 votes
Accepted

How do hackers trick frontend validation?

I think you are very confused about what both CORS and SOP do... neither is relevant to these attacks at all. There are lots of ways to bypass client-side validation. HTTP is just a stream of bytes, ...
CBHacking's user avatar
  • 48.5k
70 votes
Accepted

Will the same JavaScript fetched by HTTP and HTTPS be cached separately by the browser?

Resources are cached by their URL, and the protocol (http:// or https://) is part of the URL. Since the protocol differs, the URL must also differ, and you have two separate cache entries.
MSalters's user avatar
  • 2,689
66 votes
Accepted

Why don't browsers block cross-site POSTs by default?

In theory your suggestion is perfectly reasonable. If browsers blocked all cross origin POST requests by default, and it required a CORS policy to unlock them, a lot of all the CSRF vulnerabilities ...
Anders's user avatar
  • 65.6k
46 votes

Will the same JavaScript fetched by HTTP and HTTPS be cached separately by the browser?

It is perfectly fine if a http:// and a https:// resource provide different data, even if everything but the access method is the same. For example access to http:// will today often result in a ...
Steffen Ullrich's user avatar
39 votes

How does CSRF correlate with Same Origin Policy

Let us start by defining the term "origin". The origin of a page is decided by three unique factors: hostname, protocol and port number. For example, http://test.com and https://test.com have ...
Shurmajee's user avatar
  • 7,457
25 votes

Why doesn't a simple HTTP request to display a remote web page violate the same-origin policy?

And how can a web server distinguish between requests coming from a script and coming from a user? It doesn't. The same origin policy is enforced by the browser, not the server. The purpose of the ...
bdsl's user avatar
  • 595
24 votes

Why don't browsers block cross-site POSTs by default?

The problem is not the request method: CSRF could also be done with a GET request. The problem is instead that authentication information like (session) cookies or the Authorization header are ...
Steffen Ullrich's user avatar
23 votes

How do hackers trick frontend validation?

Maybe a very short answer will help as well. I never thought about it much, I just thought this meant someone could bypass the validations by making a request on something like Postman. But then I ...
Vincent's user avatar
  • 329
14 votes
Accepted

Why doesn't a simple HTTP request to display a remote web page violate the same-origin policy?

If one enters a URL in the browser one starts with a new empty origin, i.e. no domain and port belong to the origin initially. Everything can be put into a window/tab with an empty origin and once it ...
Steffen Ullrich's user avatar
14 votes

Why doesn't a simple HTTP request to display a remote web page violate the same-origin policy?

The simple answer to your question is that "requests to display a web page" are what set the origin, so obviously they cannot violate same-origin policy. Things that happen within a page (...
CBHacking's user avatar
  • 48.5k
12 votes
Accepted

How is the lack of the "SameSite" cookie flag a risk?

The goals of the SameSite flag are: prevent cross-site timing attacks (see eg here) prevent cross-site script inclusion (see here) prevent CSRF: SameSite cookies are only sent if the site the request ...
tim's user avatar
  • 29.6k
11 votes
Accepted

What attacks are mitigated by requiring CORS for subresource integrity verification?

The attack I think the attack they are trying to protect against is the following. Imagine santaclause.com serves an image at santaclause.com/naughty_or_nice.png to logged in users. The image is a ...
Anders's user avatar
  • 65.6k
11 votes

How does CSRF correlate with Same Origin Policy

Same Origin Policy (SOP) preserves the data of other domains... There are two parts to the SOP: It prevents scripts on origin A from reading data from origin B. It prevents sites on origin A from ...
Anders's user avatar
  • 65.6k
11 votes
Accepted

How did the Facebook Originull vulnerablity of Access-Control-Allow-Origin: null allow cross-origin access?

I'm Ysrael and I'm the researcher that found this vulnerability. Let's divide your question into 2 parts: A. How did the Origin of the browser become null? B. How the null Origin affect Facebook ...
Ysrael Gurt's user avatar
11 votes

How do hackers trick frontend validation?

Postman and same origin policy aren't obstacles. To understand this, I need to explain why, as a developer, you virtually never trust the client/front end. Front and back end trust If someone controls ...
Stilez's user avatar
  • 1,694
10 votes
Accepted

Doesn't Samesite cookie and Sameorigin policy effectively does the same job?

The Same-Origin-Policy does not prevent CSRF attacks. It does not prevent the request from being send and it does not prevent site specific credentials (i.e. session cookie) to be attached to the ...
Steffen Ullrich's user avatar
9 votes
Accepted

When does the same-origin policy prevent a request from being sent?

Would it send a request or throw an error without sending the request? Your POST request would be sent. However, the same-origin policy prevents that are you are able to read the response. Just like ...
Arminius's user avatar
  • 44.8k
9 votes
Accepted

Why is a "tainted canvas" a risk?

What exactly would that image request URL look like? It need not be anything complicated or abnormal. There are two main ways this could work (were it not for the restrictions in the browser): In ...
Anders's user avatar
  • 65.6k
9 votes

Why don't browsers block cross-site POSTs by default?

I partly disagree with Anders on But that is not how the internet was built back in the day, and there is no way to change it now. The developers of major browsers do have pretty much power to ...
Esa Jokinen's user avatar
9 votes

How do hackers trick frontend validation?

Your backend is accessible via the network. That means I don't need to use your frontend. I can find out what endpoints it uses, and and what format the request looks like, and use my own tools to ...
hobbs's user avatar
  • 647
8 votes

How is the lack of the "SameSite" cookie flag a risk?

The actual answer should be, as always: it depends on your usage scenario. The Strict value will prevent the cookie from being sent by the browser to the target site in all cross-site browsing ...
kravietz's user avatar
  • 422
8 votes

Will the same JavaScript fetched by HTTP and HTTPS be cached separately by the browser?

Summary: The primary cache key for any standards-compliant browser is an absolute URI The absolute URI begins http: for all insecure requests and https: for all secure requests Consequently, a ...
IMSoP's user avatar
  • 3,900
7 votes

How come <img> calls do not violate the Same Origin Policy?

This is considered acceptable because scripts are limited in interacting with cross origin images unless crossorigin="anonymous" is set, which tells the browser not to send cookies or other ...
AndrolGenhald's user avatar
7 votes
Accepted

Why are web font resource requests not no-cors?

This mechanism exists mainly as a way for font creators to control which websites can access their possibly copyrighted and licensed products. As MDN puts it: ... Web Fonts (for cross-domain ...
AlphaD's user avatar
  • 913
7 votes
Accepted

"Same origin policy" and XSS

how does the 'Same origin policy' prevent XSS attacks It doesn't. The SOP works when there is no XSS vulnerability. It ensures that evil.com cannot read data with your authentication from eg ...
tim's user avatar
  • 29.6k
6 votes

Is CORS and CSRF-tokens only for POST and GET requests?

Based on what you ask I think you are confusing concepts a bit: CSRF is a method to execute an authenticated action cross-site, i.e. triggered by an attacker but executed with the authentication of ...
Steffen Ullrich's user avatar
6 votes

Why is it not possible to spoof referer and origin header with XHR?

You can't set those headers, because the browsers ignore attempts to set them. Browsers ignore attempts to set them, because they aren't supposed to be script-controlled. The restriction on letting ...
CBHacking's user avatar
  • 48.5k
6 votes

How do hackers trick frontend validation?

How do hackers trick frontend validation? They don't. They simply don't do it. The question is based on a simple flaw of thought. For attackers there is no frontend validation as they simply do not ...
Frank Hopkins's user avatar
6 votes
Accepted

Does SOP prevent a class of CSRF attacks?

SOP mostly does not stop CSRF - the entire point of CSRF is that it's an attack you can make despite SOP, and which (unlike XSS) doesn't require an injection vulnerability - but in some cases SOP does ...
CBHacking's user avatar
  • 48.5k
5 votes

How does CSRF correlate with Same Origin Policy

A site A can cause a request to the different site B in various ways, for example with including an image from site B inside the HTML from site A (i.e. <img src=http://B/...>) or do similar things ...
Steffen Ullrich's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible