3 ms·

It is actually a pretty strange restriction, if you look at it from some distance. I remember back then, when "mashups" were all the craze, I spent a weekend wr

It is actually a pretty strange restriction, if you look at it from some distance. I remember back then, when "mashups" were all the craze, I spent a weekend writing a website that parsed another site - forgot what it was actually about - and displayed it in a nice way. It worked perfectly offline, but failed online. That was the first time I heard about the same-origin policy. The whole web security model grew organically and unplanned. Pages have access to your state and credentials, but are blocked from accessing other domains - but only under certain circumstances (e.g. loading scripts, or sending information is OK, just not "applying" your credentials). Retrospectively, it would have been much more sensible to allow scripts to access arbitrary HTTP (or even socket) addresses, but without sending cookies and credentials along when doing so. There is just so much awesome stuff you can't build now because of that. Server-less RSS readers, a Wikipedia "shell", legally or politically sensitive mashups/JS apps hosted on some anonymous freehoster, and so on.

chillingeffect 12y ago
ugh, I hear ya! I, too, built a handful of wildly-powerful active pages... I was inspired by the decks from Neuromancer... I was able to scrape pages, combine multiple pages, but it all fell apart when I ran into xss... It could still be done via proxy...
- walterbell 12y ago
  Tel Aviv startup http://tomodo.com http://tomodo.com runs a proxy that hosts mashup "mods", e.g. a mashup that injects price history into Amazon pages http://www.amazon-camelizer.tomodo.me/Kindle-Fire-HDX-Display-Wi-Fi/dp/B00CUTT4HY/ http://www.amazon-camelizer.tomodo.me/Kindle-Fire-HDX-Displa... Some discussion here, apparently only the cross-domain traffic goes via the proxy https://github.com/TOMODOcom/TOMODOkorz/issues/3 https://github.com/TOMODOcom/TOMODOkorz/issues/3
EGreg 12y ago
Well cookies have a same-origin security policy for good reason, right? You don't want a http://en.wikipedia.org/wiki/Confused_deputy_problem http://en.wikipedia.org/wiki/Confused_deputy_problem ... otherwise the web would be horribly insecure. And imagine that any site could request any document from another site that you're logged into ... I could just steal your bank account info or anything else, by writing a LOLcats site that gives you 15GB of free storage, while silently sending targeted requests to all the banks. Your cookies would be submitted along with those requests and MY SITE would get the info. Proxies can't send your cookies like the browser can. No, there are good reasons for these restrictions. Servers should whitelist certain resources and sites. Now there is only this: http://xkcd.com/792/ http://xkcd.com/792/
- captainmuon 12y ago
  Well, a script should be able to set of a naked HTTP request to `othersite.com` without sending along the cookies for `othersite.com`. I don't see how that would allow new vulnerabilities. Basically, make XMLHttpRequest not use any cookies etc. when making requests to other domains.
  - EGreg 12y ago
    Yes without cookies it should be able to, since it can via a proxy. this should be a capability of browsers
schoen 12y ago
I'm tempted to think that the reason for the difference is that Xanadu imagines documents as documents (without any code or code-equivalent to be executed by the browser) and not as part of a web application, and not with HTTP auth or cookies to convey authority to take or invoke actions. The web security model has grown up because of what you can actively do via a web app (authenticated actions), and then because of what web apps can do to each other (cross-site/cross-domain every-random-thing). In an era where Javascript was rare or nonexistent and where people typically "read" web pages rather than authenticating to them, it didn't seem very dangerous to arbitrarily include resources from one page in another. It's not clear to me to what extent Xanadu ever considered whether it wanted to be used to build interactive server-based applications with user authentication and authenticated actions, and, if so, whether it ever fleshed out a security model for that.

chillingeffect 12y ago

ugh, I hear ya! I, too, built a handful of wildly-powerful active pages... I was inspired by the decks from Neuromancer... I was able to scrape pages, combine multiple pages, but it all fell apart when I ran into xss... It could still be done via proxy...

walterbell 12y ago
Tel Aviv startup http://tomodo.com http://tomodo.com runs a proxy that hosts mashup "mods", e.g. a mashup that injects price history into Amazon pages http://www.amazon-camelizer.tomodo.me/Kindle-Fire-HDX-Display-Wi-Fi/dp/B00CUTT4HY/ http://www.amazon-camelizer.tomodo.me/Kindle-Fire-HDX-Displa... Some discussion here, apparently only the cross-domain traffic goes via the proxy https://github.com/TOMODOcom/TOMODOkorz/issues/3 https://github.com/TOMODOcom/TOMODOkorz/issues/3

EGreg 12y ago

Well cookies have a same-origin security policy for good reason, right? You don't want a http://en.wikipedia.org/wiki/Confused_deputy_problem http://en.wikipedia.org/wiki/Confused_deputy_problem ... otherwise the web would be horribly insecure. And imagine that any site could request any document from another site that you're logged into ... I could just steal your bank account info or anything else, by writing a LOLcats site that gives you 15GB of free storage, while silently sending targeted requests to all the banks. Your cookies would be submitted along with those requests and MY SITE would get the info. Proxies can't send your cookies like the browser can. No, there are good reasons for these restrictions. Servers should whitelist certain resources and sites. Now there is only this: http://xkcd.com/792/ http://xkcd.com/792/

captainmuon 12y ago
Well, a script should be able to set of a naked HTTP request to `othersite.com` without sending along the cookies for `othersite.com`. I don't see how that would allow new vulnerabilities. Basically, make XMLHttpRequest not use any cookies etc. when making requests to other domains.
- EGreg 12y ago
  Yes without cookies it should be able to, since it can via a proxy. this should be a capability of browsers

schoen 12y ago

I'm tempted to think that the reason for the difference is that Xanadu imagines documents as documents (without any code or code-equivalent to be executed by the browser) and not as part of a web application, and not with HTTP auth or cookies to convey authority to take or invoke actions. The web security model has grown up because of what you can actively do via a web app (authenticated actions), and then because of what web apps can do to each other (cross-site/cross-domain every-random-thing). In an era where Javascript was rare or nonexistent and where people typically "read" web pages rather than authenticating to them, it didn't seem very dangerous to arbitrarily include resources from one page in another. It's not clear to me to what extent Xanadu ever considered whether it wanted to be used to build interactive server-based applications with user authentication and authenticated actions, and, if so, whether it ever fleshed out a security model for that.