3 ms·
> and then sends it to evil.com. How would a man in the middle attack grant you that? This is the reason same origin policy exists. It is the foundation of w
by austincheney 8y ago
> and then sends it to evil.com.
How would a man in the middle attack grant you that? This is the reason same origin policy exists. It is the foundation of web security. If can break SOP and prove it in a demonstration you can report this issue to Google as a defect in the top tier of their bug bounty for a sizable reward.
- icebraining 8y agoWithout SSL, I can inject code directly into the main HTML, in the same origin context as yours.
- austincheney 8y agoYes, but the comment I replied to mentioned sending compromised data to a browser and then sending user data from the browser to an untrusted third party. The browser will not typically allow that due to same origin policy and certainly not if content security policy is applied.
- icebraining 8y agoYou keep saying the thing about same-origin; I wonder how you think Google Analytics and similar services work, if sites can't send data to external services. CSP headers won't ever reach the browser if the attacker has MITM, so they are irrelevant.
- austincheney 8y agoThey work the same way in HTTPS as they do in HTTP. Same origin applies to the domain of asset reference. If you have CSP in place you must specify an exception for GA or it won't work. If the attacker has MITM capabilities they can redirect the page to an untrusted location and bypass the valid server completely. MITM isn't typically limited to layer 7 unless the goal is to stand in the encrypted tunnel.