97
votes
Accepted
How do hackers trick frontend validation?
I think you are very confused about what both CORS and SOP do... neither is relevant to these attacks at all.
There are lots of ways to bypass client-side validation. HTTP is just a stream of bytes, ...
- 50.3k
70
votes
Accepted
Will the same JavaScript fetched by HTTP and HTTPS be cached separately by the browser?
Resources are cached by their URL, and the protocol (http:// or https://) is part of the URL. Since the protocol differs, the URL must also differ, and you have two separate cache entries.
- 2,689
66
votes
Accepted
Why don't browsers block cross-site POSTs by default?
In theory your suggestion is perfectly reasonable. If browsers blocked all cross origin POST requests by default, and it required a CORS policy to unlock them, a lot of all the CSRF vulnerabilities ...
- 65.7k
46
votes
Will the same JavaScript fetched by HTTP and HTTPS be cached separately by the browser?
It is perfectly fine if a http:// and a https:// resource provide different data, even if everything but the access method is the same. For example access to http:// will today often result in a ...
- 205k
39
votes
How does CSRF correlate with Same Origin Policy
Let us start by defining the term "origin". The origin of a page is decided by three unique factors: hostname, protocol and port number. For example, http://test.com and https://test.com have ...
- 7,487
25
votes
Why doesn't a simple HTTP request to display a remote web page violate the same-origin policy?
And how can a web server distinguish between requests coming from a script and coming from a user?
It doesn't. The same origin policy is enforced by the browser, not the server.
The purpose of the ...
- 795
24
votes
Why don't browsers block cross-site POSTs by default?
The problem is not the request method: CSRF could also be done with a GET request. The problem is instead that authentication information like (session) cookies or the Authorization header are ...
- 205k
23
votes
How do hackers trick frontend validation?
Maybe a very short answer will help as well.
I never thought about it much, I just thought this meant someone could
bypass the validations by making a request on something like Postman.
But then I ...
- 329
14
votes
Accepted
Why doesn't a simple HTTP request to display a remote web page violate the same-origin policy?
If one enters a URL in the browser one starts with a new empty origin, i.e. no domain and port belong to the origin initially. Everything can be put into a window/tab with an empty origin and once it ...
- 205k
14
votes
Why doesn't a simple HTTP request to display a remote web page violate the same-origin policy?
The simple answer to your question is that "requests to display a web page" are what set the origin, so obviously they cannot violate same-origin policy. Things that happen within a page (...
- 50.3k
12
votes
How does CSRF correlate with Same Origin Policy
Same Origin Policy (SOP) preserves the data of other domains...
There are two parts to the SOP:
It prevents scripts on origin A from reading data from origin B.
It prevents sites on origin A from ...
- 65.7k
12
votes
Accepted
How is the lack of the "SameSite" cookie flag a risk?
The goals of the SameSite flag are:
prevent cross-site timing attacks (see eg here)
prevent cross-site script inclusion (see here)
prevent CSRF: SameSite cookies are only sent if the site the request ...
- 29.7k
11
votes
Accepted
How did the Facebook Originull vulnerablity of Access-Control-Allow-Origin: null allow cross-origin access?
I'm Ysrael and I'm the researcher that found this vulnerability.
Let's divide your question into 2 parts:
A. How did the Origin of the browser become null?
B. How the null Origin affect Facebook ...
- 126
11
votes
Accepted
What attacks are mitigated by requiring CORS for subresource integrity verification?
The attack
I think the attack they are trying to protect against is the following.
Imagine santaclause.com serves an image at santaclause.com/naughty_or_nice.png to logged in users. The image is a ...
- 65.7k
11
votes
How do hackers trick frontend validation?
Postman and same origin policy aren't obstacles. To understand this, I need to explain why, as a developer, you virtually never trust the client/front end.
Front and back end trust
If someone controls ...
- 1,694
10
votes
Accepted
Doesn't Samesite cookie and Sameorigin policy effectively does the same job?
The Same-Origin-Policy does not prevent CSRF attacks. It does not prevent the request from being send and it does not prevent site specific credentials (i.e. session cookie) to be attached to the ...
- 205k
9
votes
Accepted
When does the same-origin policy prevent a request from being sent?
Would it send a request or throw an error without sending the request?
Your POST request would be sent. However, the same-origin policy prevents that are you are able to read the response. Just like ...
- 45k
9
votes
Accepted
Why is a "tainted canvas" a risk?
What exactly would that image request URL look like?
It need not be anything complicated or abnormal. There are two main ways this could work (were it not for the restrictions in the browser):
In ...
- 65.7k
9
votes
Why don't browsers block cross-site POSTs by default?
I partly disagree with Anders on
But that is not how the internet was built back in the day, and there
is no way to change it now.
The developers of major browsers do have pretty much power to ...
- 19.2k
9
votes
How do hackers trick frontend validation?
Your backend is accessible via the network. That means I don't need to use your frontend. I can find out what endpoints it uses, and and what format the request looks like, and use my own tools to ...
- 646
8
votes
How is the lack of the "SameSite" cookie flag a risk?
The actual answer should be, as always: it depends on your usage scenario.
The Strict value will prevent the cookie from being sent by the browser
to the target site in all cross-site browsing ...
- 422
8
votes
Accepted
Why are web font resource requests not no-cors?
This mechanism exists mainly as a way for font creators to control which websites can access their possibly copyrighted and licensed products.
As MDN puts it:
... Web Fonts (for cross-domain ...
- 953
8
votes
Will the same JavaScript fetched by HTTP and HTTPS be cached separately by the browser?
Summary:
The primary cache key for any standards-compliant browser is an absolute URI
The absolute URI begins http: for all insecure requests and https: for all secure requests
Consequently, a ...
- 3,910
7
votes
How come <img> calls do not violate the Same Origin Policy?
This is considered acceptable because scripts are limited in interacting with cross origin images unless crossorigin="anonymous" is set, which tells the browser not to send cookies or other ...
- 15.8k
7
votes
Accepted
"Same origin policy" and XSS
how does the 'Same origin policy' prevent XSS attacks
It doesn't.
The SOP works when there is no XSS vulnerability.
It ensures that evil.com cannot read data with your authentication from eg ...
- 29.7k
6
votes
Is CORS and CSRF-tokens only for POST and GET requests?
Based on what you ask I think you are confusing concepts a bit:
CSRF is a method to execute an authenticated action cross-site, i.e. triggered by an attacker but executed with the authentication of ...
- 205k
6
votes
Why is it not possible to spoof referer and origin header with XHR?
You can't set those headers, because the browsers ignore attempts to set them. Browsers ignore attempts to set them, because they aren't supposed to be script-controlled. The restriction on letting ...
- 50.3k
6
votes
How do hackers trick frontend validation?
How do hackers trick frontend validation?
They don't. They simply don't do it.
The question is based on a simple flaw of thought. For attackers there is no frontend validation as they simply do not ...
- 633
6
votes
Accepted
Does SOP prevent a class of CSRF attacks?
SOP mostly does not stop CSRF - the entire point of CSRF is that it's an attack you can make despite SOP, and which (unlike XSS) doesn't require an injection vulnerability - but in some cases SOP does ...
- 50.3k
5
votes
How does CSRF correlate with Same Origin Policy
A site A can cause a request to the different site B in various ways, for example with including an image from site B inside the HTML from site A (i.e. <img src=http://B/...>) or do similar things ...
- 205k
Only top scored, non community-wiki answers of a minimum length are eligible