Saturday, October 1, 2011

Foundations: Origin

Every discussion of the security architecture of the web platform should begin with the notion of an origin.  An origin is the basic unit of isolation in the web platform.  Every object in the browser is associated with an origin, which defines its security context.  When a script running in one origin tries to access an object, the browser checks whether the script's origin has access to the object's origin.

So what is an origin?  Simply put, an origin is the scheme, host, and port of the URL associated with the object.  (Hence the name of this blog.)  For example, if you're viewing an article on New York Times in your browser, that article (and all of its associated objects) are in the http://www.nytimes.com origin.  This blog exists in the http://www.schemehostport.com origin, which means there is a security boundary between this blog and the New York Times.  Of course, there are many subtleties to that security boundary, which we'll get to in due course.

Many folks have written about the browser's origin-based security model, which is often referred to as the same-origin policy because, in the usual case, the browser allows one object to access another if the two objects are in "the same" origin.

If you'd like to learn more about the same-origin policy, one popular reference is Jesse Ruderman's wiki page, but, despite origin's central role in web security, there isn't a specification explaining how the same-origin policy works!  To fix that, I've been working with the IETF's websec working group to write a specification of the web origin concept.  There are still a handful of issues to address, but hopefully finish working through the IETF process soon.

45 comments:

  1. Once you get past the high level, the most thorough public description of the many different 'definitions' of SOP that I am aware of is from Michal Zalewski's browser security document:
    http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy

    It's possible that some points there might be out of date, but I don't know that anyone is keeping track closely.

    Notably, that document shows that even a specification containing a straightforward formulation of the SOP will not have all major browsers in compliance (and I doubt that will change). Also, there will remain important differences in the details of how it is applied.

    ReplyDelete
  2. The topic of this blog is just fantastic, the blog is quite informative too. Thanks for posting!
    Supernatural Jacket

    ReplyDelete
  3. Wow, It's possible that some points there might be out of date, but I don't know that anyone can keeping track closely.
    Hostgator Coupons

    ReplyDelete
  4. This is a great post ! it was very informative. I look forward in reading more of your work. Also, I made sure to bookmark your website so I can come back later. I enjoyed every moment of reading it.
    baju batik modern baju batik baju batik wanita batik pekalongan batik couple batik online batik modern gamis batik

    ReplyDelete
  5. Great blog here with all of the valuable information you have. Keep up the good work you are doing here.
    Black magic to get your love back

    ReplyDelete
  6. This is great do you have a catologue if so I would love one to share with friends and family.
    Bookmyshow T20 Cricket World Cup Tickets Buy
    ICC T20 World Cup 2016 Qualifier Venues Groups

    ReplyDelete
  7. What solid post this is for me and usually posts some really exciting stuff like this.We, Arabia wasj Co.Ltd.,are working as one team since years, we do aspire to become the pioneers and characteristic in the field of contracting as we lways keen to attract best administrative and technical capabalities with highly acclaimed expertise with success to fit together in one complete group able to carry out large projects. شركة وسج العربية

    ReplyDelete
  8. After study a few of the blog posts on your website now, and I truly like your way of

    blogging.Steel boned corsets can reduce your waist line by 4-5 inches,silhouette

    (examples: hourglass, conical, s-curve) of corset that is best for everyone.Wholesale

    Price,Best Quality.http://www.latexcorsets.com/steel-boned-corsets-c-200.html

    ReplyDelete
  9. Hey guys!! also check the all latest updates of Vivo IPL t20 2016 live streaming-

    Vivo ipl t20 live on Sony Max

    ReplyDelete
  10. It is the best time to make plans for the future and it's time to be happy. I have read this post and if I could I wish to suggest you few interesting things or advice. Maybe you could write next articles referring to this article. I want to read even more things about it!
    http://www.friv30game.com/
    http://www.friv2gamers.com/
    http://www.denygiochi.it/
    http://www.denyjeux.fr/

    ReplyDelete
  11. http://www.movies-out.com/2016/03/tom-hanks-acts-out-his-movies-in-six-minutes.html
    http://www.movies-out.com/2016/03/batman-vs-superman-who-is-better.html

    ReplyDelete
  12. You’ve written nice post, I am gonna bookmark this page, thanks for info. I actually appreciate your own position and I will be sure to come back here.
    mortal kombat x, a10, roblox, color switch

    ReplyDelete
  13. Very useful post. This is my first time i visit here. I found so many interesting stuff in your blog especially its discussion. Really its great article. Keep it up!
    cat mario
    clicker heroes
    cubefield
    curve fever
    dragon ball z devolution
    duck life
    gun mayhem 2

    ReplyDelete
  14. vashikaran specialist in ghaziabad
    nice post keep sharing

    ReplyDelete
  15. Let’s keep out sites for your child! click:
    brain games | puzzle games | tetris | happy wheels | agario | abcya | fnaf 4 | super mario games
    To play for free!

    ReplyDelete
  16. Thanks for this info. Keep up the neat work. I'll be returning often thanks for sharing...
    Got Release Date in UK USA Australia
    Watch Got with English Subtitles

    ReplyDelete
  17. This comment has been removed by the author.

    ReplyDelete