The same-origin-policy is one of several models that web browsers use to determine which JavaScript files in a webpage should be executed. This is determined by the domain (the origin).
Questions tagged [same-origin-policy]
146 questions
4
votes
3 answers
Flash ignores Content-Type header, allowing XSS?
I recently read that the Flash plugin ignores the Content-Type header in certain circumstances. In particular, you can give Flash a URL, and the Flash plugin will happily fetch the content at that URL and load whatever it receives as a SWF file,…
![](../../users/profiles/971.webp)
D.W.
- 98,420
- 30
- 267
- 572
4
votes
2 answers
Securely render SVG
How can I securely render SVG documents in a media sharing application?
I think the same-origin policy might help a bit if I host the SVG documents on a separate domain and render them inside an
![](../../users/profiles/4155.webp)
joar
- 495
- 3
- 6
4
votes
1 answer
In which ways could a javascript making a cross domain HEAD request be a threat?
I was just reading this answer to the question Why is the same origin policy so important?
Basically, when you try to make an XMLHttpRequest to a different
domain, the browser will do one of two things:
If it's a GET or POST request which meets…
![](../../users/profiles/8518.webp)
ian
- 1,302
- 11
- 21
4
votes
2 answers
Defense against same origin attacks?
The Question:
How do I, as the victim, protect my site from being manipulated into doing something it's not supposed to, on a shared host? Same-Origin policy looks the other way. Most convenient would probably be if I could somehow say something…
![](../../users/profiles/22586.webp)
Gima
- 143
- 4
4
votes
1 answer
"Same origin policy" and XSS
I understand SOP, 'Same origin policy' is supposed to prevent script code with origin x from accessing data with origin y. Origin is said to be a tuple of protocol, domain and port.
This explains what SOP is and why it is important, but not so much…
![](../../users/profiles/223316.webp)
monolith
- 143
- 1
- 5
4
votes
1 answer
Why are web font resource requests not no-cors?
CSS, JS, images etc are all fetched as no-cors. What's different about web fonts?
Per the spec:
For font loads, user agents must use the potentially CORS-enabled fetch method defined by the [FETCH] specification for URL's defined within @font-face…
![](../../users/profiles/133881.webp)
Adam Williams
- 363
- 2
- 8
4
votes
1 answer
Client-side cross-site access in SSL environment - when it's still possible to do?
I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing connections enabled, and all incoming connections will…
![](../../users/profiles/420.webp)
kagali-san
- 171
- 3
4
votes
0 answers
Configure Access-Control-Allow-Origin for clients with origin: null
I develop a web app. When I run the app on Android, origin in the header of a network request is null. Access-Control-Allow-Origin in the response header is null too, because the origin of the resource is something like file://..., which is changed…
![](../../users/profiles/174175.webp)
nightlyop
- 141
- 1
- 3
3
votes
1 answer
Uses of same origin policy
I am trying to understand what use cases exist for the use of Same Origin Policy (SOP).
SOP prevents a document or script loaded from one origin to interact with a resource from another origin.
But in what scenarios is this really used? From this…
![](../../users/profiles/42517.webp)
Jake
- 1,095
- 3
- 12
- 20
3
votes
3 answers
Understanding SOP in multiple tabs
I am reading another answer on this website.
It says:
Assume you are logged into Facebook and visit a malicious website in
another browser tab. Without the same origin policy JavaScript on that
website could do anything to your Facebook account…
![](../../users/profiles/42517.webp)
Jake
- 1,095
- 3
- 12
- 20
3
votes
1 answer
How does the same-origin policy apply between browser tabs?
Let's assume that we have 2 open tabs in a browser containing page A (A.html, A.js) into the first tab and page B (B.html, B.js) into the second tab and that page A and B have the same origin (scheme, domain, port).
Can A.js call a function from…
![](../../users/profiles/57040.webp)
westbeam87
- 419
- 4
- 11
3
votes
3 answers
How is the same origin policy causing my PoC to fail when I don't need to read return data?
I'm performing an authorized vulnerability analysis on a custom web service and have discovered a CSRF vulnerability.
Due to there not being form tokens coupled with the service not checking for the origin header I believed I could forge requests…
![](../../users/profiles/58856.webp)
Ryan
- 133
- 1
- 5
3
votes
1 answer
Understanding Same origin policy
I am trying to understand same origin policy better. From what I understand same origin policy restricts code from one "origin" not access data from another "origin". What I am trying to understand is the context of this code. I can see that code…
![](../../users/profiles/6937.webp)
user220201
- 893
- 9
- 22
3
votes
1 answer
In Same Origin Policy, why are different protocols considered a security violation?
I can understand why content from different domains is considered to be unstrusted for the same origin policy. But, how can be content from diferent protocols from the same site/domain be dangerous?
Can somebody give an example of a situation in…
![](../../users/profiles/36124.webp)
Gabriel Talavera
- 213
- 1
- 7
3
votes
1 answer
Access-Control-Allow-Origin wihout AJAX
This answer (incorrectly?) states
No, as long as the CORS Access-Control-Allow-Origin is at its default restrictive value. This prevents the outer website from accessing the framed website via Javascript/etc.
However, I was pretty sure that a…
![](../../users/profiles/8340.webp)
SilverlightFox
- 33,408
- 6
- 67
- 178