Collaborate Disseminate
I’m not a web developer, but I have read about the importance of the same origin policy (SOP) and Cross-Origin Resource Sharing (CORS). I can’t find studies or best practices related to the origin itself. In my understanding,… Continue reading App naming convention vs Same Origin Policy and Cross-Origin Resource Sharing
This is not the same question as Why is the same origin policy so important?.
That one asks only about why cookies are only ever send to origin they came from, which I understand.
What I don’t understand is why there’s a re… Continue reading Why is the same origin policy sensible – for requests?
Mozilla’s Firefox browser doesn’t have site isolation security yet, but plans to enable it are in the works. Continue reading Mozilla still working on Firefox’s site isolation security revamp
I’m a bit confused regarding the subject of Same Origin Policy (SOP). If I understand correctly, the purpose of the SOP is to prevent one page from obtaining access to sensitive data on another web page.
So for example, how come I can sim… Continue reading How come <img> calls do not violate the Same Origin Policy?
I was rather surprised that in my experiments, I could simply connect from one website to a WebSocket server on a different domain/port pair. Subsequent research repeatedly showed that WebSockets do not fall under the Same Or… Continue reading What are the design considerations behind exempting WebSockets from the SOP?
I have the following questions regarding CSRF, SOP and CORS.
Does CSRF tokens only protect form submission with either POST or GET methods? Is this just a “common practice” (regarding the fact that only form submissions are… Continue reading Is CORS and CSRF-tokens only for POST and GET requests?
Same-origin policy (SOP) makes browsers block scripting from one origin to mess with another, unless explicitly being told not to do so. But cross-site POSTs are still allowed, creating the vector for CSRF attacks. The defens… Continue reading Why don’t browsers block cross-site POSTs by default?
Same-origin Policy (SOP) is a set of restrictions originally implemented by Netscape developers to help securely manage the relationships and connections between web resources such as HTML documents and other content, APIs and cookies. It enabled each … Continue reading Introducing the Same-origin Policy Whitepaper
I’m not familiar with Javascript, but I want to know what can’t be done in this steps in order to bypass SOP and extract sensitive data :
set the tag <script src=”https://facebook.com/messages”></script>
the bro… Continue reading Why can’t bypass SOP using "src" attribut in script tag?
I develop a web app. When I run the app on Android, origin in the header of a network request is null. Access-Control-Allow-Origin in the response header is null too, because the origin of the resource is something like file:… Continue reading Configure Access-Control-Allow-Origin for clients with origin: null