Difference between revisions of "Same Origin Policy"
From MgmtWiki
m (→Meme) |
(→Context) |
||
| Line 5: | Line 5: | ||
# Threats Mitigated by the Same-Origin Policy | # Threats Mitigated by the Same-Origin Policy | ||
| − | + | ## Cross-Site Scripting (XSS) Data Theft** | |
| − | ## | + | ### Threat**: Malicious scripts injected into a trusted site could access sensitive data (cookies, localStorage, session info). |
| − | + | ### SOP Defense**: Prevents scripts from reading data from other origins, even if embedded. | |
| − | + | ## Cross-Site Request Forgery (CSRF)** | |
| − | + | ### Threat**: An attacker tricks a user’s browser into sending authenticated requests to another site. | |
| − | ## | + | ### SOP Defense**: Restricts cross-origin access to response data, making CSRF harder to exploit without additional vectors. |
| − | + | ## Session Hijacking via Embedded Requests** | |
| − | + | ### Threat**: A malicious site embeds content from another origin and tries to read session-specific responses. | |
| − | + | ### SOP Defense**: Blocks JavaScript from accessing embedded content (e.g., iframes, images) from other origins. | |
| − | ## | + | ## Credential Leakage** |
| − | + | ### Threat**: Unauthorized access to cookies, tokens, or headers tied to another origin. | |
| − | + | ### SOP Defense**: Ensures that only scripts from the same origin can access these credentials. | |
| − | + | ## Unauthorized DOM Access** | |
| − | + | ### Threat**: Scripts from one origin manipulate or inspect the DOM of another origin (e.g., popup windows, iframes). | |
| − | + | ### SOP Defense**: Prevents cross-origin DOM access, preserving UI integrity and user privacy. | |
| − | |||
| − | |||
| − | ## | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
# How SOP Works | # How SOP Works | ||
- Defines “origin” as the **scheme (protocol), host (domain), and port**. | - Defines “origin” as the **scheme (protocol), host (domain), and port**. | ||
Revision as of 11:09, 21 November 2025
Contents
Meme
The Same Origin Policy (SOP) addresses key web security threats by preventing scripts from one origin from accessing data or resources from another origin. It protects against cross-site attacks like XSS, CSRF, and data theft.
Context
- Threats Mitigated by the Same-Origin Policy
- Cross-Site Scripting (XSS) Data Theft**
- Threat**: Malicious scripts injected into a trusted site could access sensitive data (cookies, localStorage, session info).
- SOP Defense**: Prevents scripts from reading data from other origins, even if embedded.
- Cross-Site Request Forgery (CSRF)**
- Threat**: An attacker tricks a user’s browser into sending authenticated requests to another site.
- SOP Defense**: Restricts cross-origin access to response data, making CSRF harder to exploit without additional vectors.
- Session Hijacking via Embedded Requests**
- Threat**: A malicious site embeds content from another origin and tries to read session-specific responses.
- SOP Defense**: Blocks JavaScript from accessing embedded content (e.g., iframes, images) from other origins.
- Credential Leakage**
- Threat**: Unauthorized access to cookies, tokens, or headers tied to another origin.
- SOP Defense**: Ensures that only scripts from the same origin can access these credentials.
- Unauthorized DOM Access**
- Threat**: Scripts from one origin manipulate or inspect the DOM of another origin (e.g., popup windows, iframes).
- SOP Defense**: Prevents cross-origin DOM access, preserving UI integrity and user privacy.
- Cross-Site Scripting (XSS) Data Theft**
- How SOP Works
- Defines “origin” as the **scheme (protocol), host (domain), and port**. - Two pages are same-origin only if all three match. - SOP restricts:
- JavaScript access to cross-origin content. - Reading response data from cross-origin requests. - DOM manipulation across origins.
Solution
The Same-Origin Policy is a **foundational browser security mechanism** that blocks malicious cross-origin interactions. It protects users from **data theft, session hijacking, and unauthorized access**, making it essential for safe web browsing.
