the-web-application-hackers-handbook

64 Chapter 3 n Web Application Technologies
Same-Origin Policy
The same-origin policy is a key mechanism implemented within browsers that
is designed to keep content that came from different origins from interfering
with each other. Basically, content received from one website is allowed to read
and modify other content received from the same site but is not allowed to
access content received from other sites.
If the same-origin policy did not exist, and an unwitting user browsed to a
malicious website, script code running on that site could access the data and
functionality of any other website also visited by the user. This may enable the
malicious site to perform funds transfers from the user’s online bank, read his
or her web mail, or capture credit card details when the user shops online. For
this reason, browsers implement restrictions to allow this type of interaction
only with content that has been received from the same origin.
In practice, applying this concept to the details of different web features and
technologies leads to various complications and compromises. Here are some
key features of the same-origin policy that you need to be aware of:
n A page residing on one domain can cause an arbitrary request to be made
to another domain (for example, by submitting a form or loading an
image). But it cannot itself process the data returned from that request.
n A page residing on one domain can load a script from another domain and
execute this within its own context. This is because scripts are assumed
to contain code, rather than data, so cross-domain access should not lead
to disclosure of any sensitive information.
n A page residing on one domain cannot read or modify the cookies or
other DOM data belonging to another domain.
These features can lead to various cross-domain attacks, such as inducing
user actions and capturing data. Further complications arise with browser
extension technologies, which implement same-origin restrictions in different
ways. These issues are discussed in detail in Chapter 13.
HTML5
HTML5 is a major update to the HTML standard. HTML5 currently is still under
development and is only partially implemented within browsers.
From a security perspective, HTML5 is primarily of interest for the following
reasons:
n It introduces various new tags, attributes, and APIs that can be leveraged
to deliver cross-site scripting and other attacks, as described in
Chapter 12.