Saturday, October 1, 2011

Foundations: Origin

Every discussion of the security architecture of the web platform should begin with the notion of an origin.  An origin is the basic unit of isolation in the web platform.  Every object in the browser is associated with an origin, which defines its security context.  When a script running in one origin tries to access an object, the browser checks whether the script's origin has access to the object's origin.

So what is an origin?  Simply put, an origin is the scheme, host, and port of the URL associated with the object.  (Hence the name of this blog.)  For example, if you're viewing an article on New York Times in your browser, that article (and all of its associated objects) are in the origin.  This blog exists in the origin, which means there is a security boundary between this blog and the New York Times.  Of course, there are many subtleties to that security boundary, which we'll get to in due course.

Many folks have written about the browser's origin-based security model, which is often referred to as the same-origin policy because, in the usual case, the browser allows one object to access another if the two objects are in "the same" origin.

If you'd like to learn more about the same-origin policy, one popular reference is Jesse Ruderman's wiki page, but, despite origin's central role in web security, there isn't a specification explaining how the same-origin policy works!  To fix that, I've been working with the IETF's websec working group to write a specification of the web origin concept.  There are still a handful of issues to address, but hopefully finish working through the IETF process soon.


  1. Once you get past the high level, the most thorough public description of the many different 'definitions' of SOP that I am aware of is from Michal Zalewski's browser security document:

    It's possible that some points there might be out of date, but I don't know that anyone is keeping track closely.

    Notably, that document shows that even a specification containing a straightforward formulation of the SOP will not have all major browsers in compliance (and I doubt that will change). Also, there will remain important differences in the details of how it is applied.

  2. The topic of this blog is just fantastic, the blog is quite informative too. Thanks for posting!
    Supernatural Jacket

  3. Wow, It's possible that some points there might be out of date, but I don't know that anyone can keeping track closely.
    Hostgator Coupons

  4. This is a great post ! it was very informative. I look forward in reading more of your work. Also, I made sure to bookmark your website so I can come back later. I enjoyed every moment of reading it.
    baju batik modern baju batik baju batik wanita batik pekalongan batik couple batik online batik modern gamis batik

  5. Great blog here with all of the valuable information you have. Keep up the good work you are doing here.
    Black magic to get your love back

  6. This is great do you have a catologue if so I would love one to share with friends and family.
    Bookmyshow T20 Cricket World Cup Tickets Buy
    ICC T20 World Cup 2016 Qualifier Venues Groups

  7. What solid post this is for me and usually posts some really exciting stuff like this.We, Arabia wasj Co.Ltd.,are working as one team since years, we do aspire to become the pioneers and characteristic in the field of contracting as we lways keen to attract best administrative and technical capabalities with highly acclaimed expertise with success to fit together in one complete group able to carry out large projects. شركة وسج العربية

  8. After study a few of the blog posts on your website now, and I truly like your way of

    blogging.Steel boned corsets can reduce your waist line by 4-5 inches,silhouette

    (examples: hourglass, conical, s-curve) of corset that is best for everyone.Wholesale

    Price,Best Quality.

  9. Hey guys!! also check the all latest updates of Vivo IPL t20 2016 live streaming-

    Vivo ipl t20 live on Sony Max

  10. It is the best time to make plans for the future and it's time to be happy. I have read this post and if I could I wish to suggest you few interesting things or advice. Maybe you could write next articles referring to this article. I want to read even more things about it!


  12. You’ve written nice post, I am gonna bookmark this page, thanks for info. I actually appreciate your own position and I will be sure to come back here.
    mortal kombat x, a10, roblox, color switch

  13. Very useful post. This is my first time i visit here. I found so many interesting stuff in your blog especially its discussion. Really its great article. Keep it up!
    cat mario
    clicker heroes
    curve fever
    dragon ball z devolution
    duck life
    gun mayhem 2

  14. vashikaran specialist in ghaziabad
    nice post keep sharing

  15. Let’s keep out sites for your child! click:
    brain games | puzzle games | tetris | happy wheels | agario | abcya | fnaf 4 | super mario games
    To play for free!

  16. Thanks for this info. Keep up the neat work. I'll be returning often thanks for sharing...
    Got Release Date in UK USA Australia
    Watch Got with English Subtitles

  17. This comment has been removed by the author.

  18. i have seen your article really i like it thanks for sharing it .

    Escorts jaipur

    Escorts dehradun

  19. Let’s keep are safe place to play the very best free games for kids! Please click: | | happy wheels | abcya | fnaf 4 to play for free!

  20. With a Hotmail account, you can send and receive emails quickly and easily as well as login and use all Microsoft services.
    hotmail login | recover hotmail password

    This is the game so players feel very fierce , adventurous . You try to join and play this game , you will feel great like.
    fireboy and watergirl 2 | learn to fly | gun mayhem 2 | slitherio
    strike force heroes | strike force heroes 4 | tank trouble 2 | age of war

  21. I must appreciate the way you have expressed your feelingsthrough your blog!. Click here to play. | dog games | fighting games | mickey mouse games | Subway Surfers



  23. this is one of the cult game now, a lot of people enjoy playing them . Also you can refer to the game :
    age of war | red ball | earn to die 5 | Tank trouble | happy wheels | earn to die 6
    The game controls are shown just under . Movement mechanisms primarily include acceleration and tilting controls.
    tank trouble unblocked | wings io | strike force heroes | age of war | hotmail login

  24. Goa Escort

    In today's dynamic world, the Call Girls are having impact as far as amusement industry where clients are attracted by an adorable desire given by these young ladies. Above all else guests coming to India will settle available to come back to work young ladies to serve their requirements which increases the value of their visit to goa. With the blasting number of guests accessible if the need arises young ladies organizing sites is going to build step by step. In the long run increasingly Call Girls, goa Escort Services and goa Female Escorts are coming into operations ordinary and contracting fresher and experienced Call Girls left and right.

    Goa Female Escort

  25. Great post....Thank you for posting the great content……I found it quiet interesting, hopefully you will keep posting such blogs… best immigration consultants in jalandhar

  26. Call us O98157273O2 Jalandhar Escorts are classified as the cautiously selected couple of college your current unlimited fantasies.Take Support inside jalandhar present companies not merely inside jalandhar although anywhere in Of india.
    Call Girl In Jalandhar Prince O98157273O2 High Profile Jalandhar Call Girl
    Call Girl In Jalandhar Prince O98157273O2 High Profile Jalandhar Call Girl
    Call Girl In Jalandhar Prince O98157273O2 High Profile Jalandhar Call Girl
    Call Girl In Jalandhar Prince O98157273O2 High Profile Jalandhar Call Girl
    Call Girl In Jalandhar Prince O98157273O2 High Profile Jalandhar Call Girl

  27. I was working and suddenly I visits your site frequently and recommended it to me to read also. Age Of War 2
    Big Farm | Slitherio
    Tank Trouble | Happy Wheels
    Goodgeme Empire |

  28. The blog or and best that is extremely useful to keep I can share the ideas
    of the future as this is really what I was looking for, I am very comfortable and pleased to come here. Thank you very much.
    gold miner|stick war 3| pokemongo
    | stick man|animal jam login

  29. Great! Thanks for sharing the information. That is very helpful for increasing my knowledge in this field.
    subway surfers | run 3 | Click jogos| temple run 2| fnaf sister location | juegos gratis | juegos de futbol

  30. No more longing to become renowned at present. Buy Facebook Followers as a way to get fame and acceptance online in a shorter duration. increase facebook followers


  31. Our Dolphins Flag is constructed of polyester, measures 3x5 feet, and has two metal grommets for attaching to a traditional flagpole, tailgate pole, or our 6' aluminum flagpole. The perimeter of our Dolphins Flag is double stitched and the Officially Licensed NFL Miami Dolphins team logos are dye sublimated into the flag so they won't peel. Due to its large size, this flag is also perfect to hang in your game room, sports room, office, or kids room.
    sports flags,
    nfl flags wholesale,New England Patriots stars and stripes flags
    cheap New Orleans Saints american banners

  32. Il nuovo maglia di casa Roma 16-17 introduce un design sobrio. Realizzato da Nike e non con eventuali loghi degli sponsor per il momento, la maglia della Roma 2016-17 è stato rilasciato il 6 luglio 2016.maglie calcio poco prezzo,
    maglie da calcio a poco prezzo, Maglia real madrid a poco prezzo 2017
    nuove Maglia Atletico Madrid prezzo

  33. This blog is so nice to me. I will continue to come here again and again. Visit my link as well. Good luck
    temple run 2