New answers tagged

3

The difference is simple: the computer user chooses which website address to type into their browser. They do not choose which website addresses that site then tries to exchange information with. That key distinction means we need protections on the latter, but not the former. Of course, an equivalent of that protection for the former would mean you could ...


26

And how can a web server distinguish between requests coming from a script and coming from a user? It doesn't. The same origin policy is enforced by the browser, not the server. The purpose of the Same Origin Policy (SOP) isn't to protect the server itself. Instead it's to protect confidential information which the server wishes to share with the user, but ...


2

However, the latter one violates the Same Origin Policy (SOP) if the server runs on a remote domain. No, it does not necessarily. Otherwise, XMLHttpRequest would be useless, as you observed. The point is that the HTTP request triggered by the JS program by means of XMLHttpRequest has to point to the server which delivered the website, otherwise it violates ...


14

The simple answer to your question is that "requests to display a web page" are what set the origin, so obviously they cannot violate same-origin policy. Things that happen within a page (such as JS execution and notably XHR/Fetch) are subject to various restrictions due to same-origin policy, but top-level navigation is always allowed*. * Iframes ...


14

If one enters a URL in the browser one starts with a new empty origin, i.e. no domain and port belong to the origin initially. Everything can be put into a window/tab with an empty origin and once it is put there the origin changes depending on where the data came from. If one instead calls a HTTP request from inside a loaded web page, one starts with a non-...


0

The HTTP Origin is a forbidden header name, meaning that it is set by the browser and cannot be overridden in any requests. As long as a modern browser is used and the web application returns an error if the origin header doesn't match or isn't sent, there is not a way to bypass this. Side note, as pointed out in comments, PHP does not run in the browser, as ...


Top 50 recent answers are included