4 ms·
Define "access". The SOP does not stop a page from initiating a request to any other origin, it stops it from interacting with it, so that, e.g. attacker.com ca
by anaphor 7y ago
Define "access". The SOP does not stop a page from initiating a request to any other origin, it stops it from interacting with it, so that, e.g. attacker.com cannot steal your session cookies from banking.com
You can do all kinds of things that don't violate the SOP but initiate a request:
- Link to another site
- Redirect someone to another page using Javascript
- Link an image from another site
- Put a form that submits data to another site
- Embed video/audio from another site
- Embed an iframe from another site
Do you propose disallowing all of those things?
There are plenty of legitimate use cases for all of these things.
If you wanted to do this you would have to disallow any type of links to local servers.
- anaphor 7y agoAlso, like someone already mentioned. DNS rebinding is a thing. So the SOP can be subverted under certain circumstances (browsers will do DNS pinning to protect against this but it's not a perfect solution)
- SahAssar 7y agoEvery one of those are solved by CSP/X-Frame-Options headers, CORS headers with content-type (non-normal form content-types) checks and proper handling of HTTP Methods. DNS rebinding is solved by https, and if you are doing something sensitive over a network (even a local one) I'm going to assume https is the proper way. We have ways of handling these things, they just require a bit of reading/implementation and are unfortunately non-default.
- anaphor 7y agoWhich is sort of exactly my point. There is no need to have a blanket ban on any linking between local/non-local sites. You just need to make sure they are set up to handle requests securely.