Saturday, October 1, 2011

Foundations: Origin

Every discussion of the security architecture of the web platform should begin with the notion of an origin.  An origin is the basic unit of isolation in the web platform.  Every object in the browser is associated with an origin, which defines its security context.  When a script running in one origin tries to access an object, the browser checks whether the script's origin has access to the object's origin.

So what is an origin?  Simply put, an origin is the scheme, host, and port of the URL associated with the object.  (Hence the name of this blog.)  For example, if you're viewing an article on New York Times in your browser, that article (and all of its associated objects) are in the http://www.nytimes.com origin.  This blog exists in the http://www.schemehostport.com origin, which means there is a security boundary between this blog and the New York Times.  Of course, there are many subtleties to that security boundary, which we'll get to in due course.

Many folks have written about the browser's origin-based security model, which is often referred to as the same-origin policy because, in the usual case, the browser allows one object to access another if the two objects are in "the same" origin.

If you'd like to learn more about the same-origin policy, one popular reference is Jesse Ruderman's wiki page, but, despite origin's central role in web security, there isn't a specification explaining how the same-origin policy works!  To fix that, I've been working with the IETF's websec working group to write a specification of the web origin concept.  There are still a handful of issues to address, but hopefully finish working through the IETF process soon.

223 comments:

  1. Once you get past the high level, the most thorough public description of the many different 'definitions' of SOP that I am aware of is from Michal Zalewski's browser security document:
    http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy

    It's possible that some points there might be out of date, but I don't know that anyone is keeping track closely.

    Notably, that document shows that even a specification containing a straightforward formulation of the SOP will not have all major browsers in compliance (and I doubt that will change). Also, there will remain important differences in the details of how it is applied.

    ReplyDelete
  2. The topic of this blog is just fantastic, the blog is quite informative too. Thanks for posting!
    Supernatural Jacket

    ReplyDelete
  3. This comment has been removed by the author.

    ReplyDelete
  4. This is a great post ! it was very informative. I look forward in reading more of your work. Also, I made sure to bookmark your website so I can come back later. I enjoyed every moment of reading it.
    baju batik modern baju batik baju batik wanita batik pekalongan batik couple batik online batik modern gamis batik

    ReplyDelete
  5. Great blog here with all of the valuable information you have. Keep up the good work you are doing here.
    Black magic to get your love back

    ReplyDelete
  6. This is great do you have a catologue if so I would love one to share with friends and family.
    Bookmyshow T20 Cricket World Cup Tickets Buy
    ICC T20 World Cup 2016 Qualifier Venues Groups

    ReplyDelete
  7. What solid post this is for me and usually posts some really exciting stuff like this.We, Arabia wasj Co.Ltd.,are working as one team since years, we do aspire to become the pioneers and characteristic in the field of contracting as we lways keen to attract best administrative and technical capabalities with highly acclaimed expertise with success to fit together in one complete group able to carry out large projects. شركة وسج العربية

    ReplyDelete
  8. After study a few of the blog posts on your website now, and I truly like your way of

    blogging.Steel boned corsets can reduce your waist line by 4-5 inches,silhouette

    (examples: hourglass, conical, s-curve) of corset that is best for everyone.Wholesale

    Price,Best Quality.http://www.latexcorsets.com/steel-boned-corsets-c-200.html

    ReplyDelete
  9. Hey guys!! also check the all latest updates of Vivo IPL t20 2016 live streaming-

    Vivo ipl t20 live on Sony Max

    ReplyDelete
  10. It is the best time to make plans for the future and it's time to be happy. I have read this post and if I could I wish to suggest you few interesting things or advice. Maybe you could write next articles referring to this article. I want to read even more things about it!
    http://www.friv30game.com/
    http://www.friv2gamers.com/
    http://www.denygiochi.it/
    http://www.denyjeux.fr/

    ReplyDelete
  11. http://www.movies-out.com/2016/03/tom-hanks-acts-out-his-movies-in-six-minutes.html
    http://www.movies-out.com/2016/03/batman-vs-superman-who-is-better.html

    ReplyDelete
  12. You’ve written nice post, I am gonna bookmark this page, thanks for info. I actually appreciate your own position and I will be sure to come back here.
    mortal kombat x, a10, roblox, color switch

    ReplyDelete
  13. Very useful post. This is my first time i visit here. I found so many interesting stuff in your blog especially its discussion. Really its great article. Keep it up!
    cat mario
    clicker heroes
    cubefield
    curve fever
    dragon ball z devolution
    duck life
    gun mayhem 2

    ReplyDelete
  14. vashikaran specialist in ghaziabad
    nice post keep sharing

    ReplyDelete
  15. Let’s keep out sites for your child! click:
    brain games | puzzle games | tetris | happy wheels | agario | abcya | fnaf 4 | super mario games
    To play for free!

    ReplyDelete
  16. Thanks for this info. Keep up the neat work. I'll be returning often thanks for sharing...
    Got Release Date in UK USA Australia
    Watch Got with English Subtitles

    ReplyDelete
  17. Replies
    1. To quickly to receive the best who can give you an unforgettable evening. We work only with meticulously selected Jaipur call girls Noor ladies who quickly in your pink city Jaipur.

      Delete
  18. This comment has been removed by the author.

    ReplyDelete
  19. i have seen your article really i like it thanks for sharing it .

    Escorts jaipur

    Escorts dehradun

    ReplyDelete
  20. Let’s keep are safe place to play the very best free games for kids! Please click:
    slither.io | wings.io | happy wheels | abcya | fnaf 4 to play for free!

    ReplyDelete
  21. With a Hotmail account, you can send and receive emails quickly and easily as well as login and use all Microsoft services.
    hotmail login | recover hotmail password

    This is the game so players feel very fierce , adventurous . You try to join and play this game , you will feel great like.
    fireboy and watergirl 2 | learn to fly | gun mayhem 2 | slitherio
    strike force heroes | strike force heroes 4 | tank trouble 2 | age of war

    ReplyDelete
  22. I must appreciate the way you have expressed your feelingsthrough your blog!. Click here to play.
    vertix.io | dog games | fighting games | mickey mouse games | Subway Surfers

    ReplyDelete

  23. http://www.15aug2016images.in/2016/07/15-august-swatantrata-diwas-2016-images.html
    http://www.15aug2016images.in/2016/07/15-august-70th-independence-day-2016-3d.html
    http://www.15aug2016images.in/2016/07/15-august-2016-modi-speech-live-images.html
    http://www.15aug2016images.in/2016/07/15-august-2016-national-anthem-song.html
    http://www.15aug2016images.in/2016/07/15-august-2016-tringa-images-tri-colour.html
    http://www.15aug2016images.in/2016/07/15-august-2016-bollywood-songs-mp3-list.html
    http://www.15aug2016images.in/2016/07/15-august-2016-patriotic-poems-kavita.html
    http://www.15aug2016images.in/2016/07/70th-independence-day-15-august-2016.html
    http://www.15aug2016images.in/2016/07/15-august-2016-facebook-profile-pics-dp.html
    http://www.15aug2016images.in/2016/07/15-august-2016-status-thoughts-quotes.html
    http://www.15aug2016images.in/2016/07/15-august-2016-fb-cover-images-pics.html
    http://titfortat.in/15-august-2016-speech/happy-70th-independence-day-2016-images-1200/
    http://titfortat.in/15-august-2016-speech/15-august-70th-independence-day-2016-fb-profile-pics-1203/
    http://titfortat.in/15-august-2016-speech/15-august-2016-desh-bhakti-kavita-1189/
    http://titfortat.in/15-august-2016-speech/15-august-2016-anchoring-script-speech-1173/
    http://titfortat.in/festivals/swatantrata-diwas-2016-sms-1249/
    http://titfortat.in/festivals/swatantrata-diwas-2016-images-1243/

    ReplyDelete
  24. this is one of the cult game now, a lot of people enjoy playing them . Also you can refer to the game :
    age of war | red ball | earn to die 5 | Tank trouble | happy wheels | earn to die 6
    The game controls are shown just under . Movement mechanisms primarily include acceleration and tilting controls.
    tank trouble unblocked | wings io | strike force heroes | age of war | hotmail login

    ReplyDelete
  25. Goa Escort

    In today's dynamic world, the Call Girls are having impact as far as amusement industry where clients are attracted by an adorable desire given by these young ladies. Above all else guests coming to India will settle available to come back to work young ladies to serve their requirements which increases the value of their visit to goa. With the blasting number of guests accessible if the need arises young ladies organizing sites is going to build step by step. In the long run increasingly Call Girls, goa Escort Services and goa Female Escorts are coming into operations ordinary and contracting fresher and experienced Call Girls left and right.

    Goa Female Escort

    ReplyDelete
  26. Great post....Thank you for posting the great content……I found it quiet interesting, hopefully you will keep posting such blogs… best immigration consultants in jalandhar

    ReplyDelete
  27. Call us O98157273O2 Jalandhar Escorts are classified as the cautiously selected couple of college your current unlimited fantasies.Take Support inside jalandhar present companies not merely inside jalandhar although anywhere in Of india.
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    Call Girl In Jalandhar Prince O98157273O2 High Profile Jalandhar Call Girl
    Call Girl In Jalandhar Prince O98157273O2 High Profile Jalandhar Call Girl
    Call Girl In Jalandhar Prince O98157273O2 High Profile Jalandhar Call Girl
    Call Girl In Jalandhar Prince O98157273O2 High Profile Jalandhar Call Girl
    Call Girl In Jalandhar Prince O98157273O2 High Profile Jalandhar Call Girl
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/

    ReplyDelete
  28. I was working and suddenly I visits your site frequently and recommended it to me to read also. Age Of War 2
    Big Farm | Slitherio
    Tank Trouble | Happy Wheels
    Goodgeme Empire | Slither.io

    ReplyDelete
  29. The blog or and best that is extremely useful to keep I can share the ideas
    of the future as this is really what I was looking for, I am very comfortable and pleased to come here. Thank you very much.
    gold miner|stick war 3| pokemongo
    | stick man|animal jam login

    ReplyDelete
  30. Great! Thanks for sharing the information. That is very helpful for increasing my knowledge in this field.
    subway surfers | run 3 | Click jogos| temple run 2| fnaf sister location | juegos gratis | juegos de futbol

    ReplyDelete
  31. No more longing to become renowned at present. Buy Facebook Followers as a way to get fame and acceptance online in a shorter duration. increase facebook followers

    ReplyDelete

  32. Our Dolphins Flag is constructed of polyester, measures 3x5 feet, and has two metal grommets for attaching to a traditional flagpole, tailgate pole, or our 6' aluminum flagpole. The perimeter of our Dolphins Flag is double stitched and the Officially Licensed NFL Miami Dolphins team logos are dye sublimated into the flag so they won't peel. Due to its large size, this flag is also perfect to hang in your game room, sports room, office, or kids room.
    sports flags,
    nfl flags wholesale,New England Patriots stars and stripes flags
    cheap New Orleans Saints american banners

    ReplyDelete
  33. Il nuovo maglia di casa Roma 16-17 introduce un design sobrio. Realizzato da Nike e non con eventuali loghi degli sponsor per il momento, la maglia della Roma 2016-17 è stato rilasciato il 6 luglio 2016.maglie calcio poco prezzo,
    maglie da calcio a poco prezzo, Maglia real madrid a poco prezzo 2017
    nuove Maglia Atletico Madrid prezzo

    ReplyDelete
  34. This blog is so nice to me. I will continue to come here again and again. Visit my link as well. Good luck
    temple run 2

    ReplyDelete
  35. Thanks for sharing information it is very helpful for and informative thanks again admin I hope you will share some posts again
    www.indbabes.in

    ReplyDelete
  36. Avoid longing to get famed these days. Buy Facebook Followers as a strategy to get fame and authority online in a small span. buy facebook followers

    ReplyDelete
  37. Thank you for your post, I look for such article along time, today i find it finally. this post give me lots of advise it is very useful for me
    wings.io | supermechs | wingsio | wingsio game | super mechs | wingsio | super mechs 2 | wingsio game

    ReplyDelete
  38. This winter I'll tell him, with great things. If we were young, and we belong to each other, why not take advantage of these days?
    geometry dash 2.0 , geometry dash , geometry dash 2.0 apk , geometry dash apk , geometry dash online

    ReplyDelete
  39. When the influx of capital and go outside, will more than to have someone to think about. And not the dark house lies waiting, by a person under the porch waiting before. I'm not sure who it was you
    run 2 , run 2 game , run , play run 2 , run 3

    ReplyDelete
  40. Escort in Gurgaon is a new world phenomenon for people who like to have fun in a safe way and for people who are away for home. Escorts relax you in a very healthy way and allow you to spend quality time in the company of educated beautiful girls . Escorts in Gurgaon

    ReplyDelete
  41. Thank you for such a sweet tutorial - all this time later, I've found it and love the end result. I appreciate the time you spent sharing your skills.
    wingsio | super mechs | wingsio play | supermechs | wingsio game | super mechs 2

    ReplyDelete
  42. Every has been chosen for not solely their exceptional beauty except for being open minded and versatile. We have a tendency to specialise in providing the simplest vary of elite escorts from round the world. every and each one in every of our horny models has been chosen not just for her good charm and exotic beauty, Escorts in Gurgaon

    ReplyDelete

  43. I wanted to thank you for this excellent read!! I definitely loved every little bit of it.Cheers for the info!!!! & This is the perfect blog for anyone who wants to know about this topic
    return man , subway surfers , hola launcher , pokemon go , minecraft

    ReplyDelete
  44. I would like more information about this, because it is very nice. Thanks for sharing. Game return man play the football game for free. The game return man 3 you like it? I like play game as Stick RPG and game Potty Racers 3

    ReplyDelete
  45. Happy happy new year.Have a best and happy new year.
    Celibrate with wishes to others eg friends, parents, brothers and relatives.
    To bring close them with yourself.
    Best New Year SMS 2017
    New Year 2017 Wishes

    ReplyDelete
  46. Pipeline leak detection is used to determine if and in some cases where a leak has occurred in systems which contain liquids and gases. Methods of detection include hydrostatic testing, infrared, and laser technology after pipeline erection and leak detection during service.
    عزل اسطح بالمدينة المنورة
    شركة عزل الاسطح بالرياض
    تسليك مجاري بالدمام
    تسليك مجاري بالرياض
    جلى بلاط بالرياض

    ReplyDelete
  47. Nice information. Thanks for sharing this article. It helps me much :) Please keep sharing us the latest information
    run 2 game | atari breakout | supermechs| wingsio | super mechs | wingsio game | super mechs 2

    ReplyDelete
  48. Life after hours of work stress and fatigue is the space I really love. I can play games, take photos or simply surfing facebook, chatting with friends. It made me feel so comfortable and pleasan

    baixar facebook , geometry dash , run 2 , strike force heroes 2 , square quick

    ReplyDelete
  49. Packers and movers in Gurgaon
    Movers and packers in Gurgaon
    Packers and movers Gurgaon
    Movers and packers Gurgaon
    http://www.multipackersmovers.in/packers-and-movers-in-gurgaon/
    http://www.multipackersmovers.in/packers-and-movers-in-pune/

    ReplyDelete
  50. New Year is the best event for everyone so celebrate this New Year 2017 with us and send some wonderful and awesome New Year Wishes, Greeting, Quotes and many more for your Love ones.
    New Year Wishes 2017
    New Year Wishes 2017

    ReplyDelete
  51. This is one of the cult game now, a lot of people enjoy playing them . Also you can refer to the game :
    gold mine strike | pokemon go 2
    The game controls are shown just under . Movement mechanisms primarily include acceleration and tilting controls.
    stickman games | stick war 2 | animal jam 2

    ReplyDelete
  52. MPBSE Dept. soon issue the date of MP Board 12 Board Result 2017 & also Download CTET Result 20177 & those who want to download Valentines Day 2017 Wall Paper Click here

    ReplyDelete
  53. Punjab Education Board will be going to issues out PSEB 10th Result 2017 in the month of May, 2017 for all of you. Check & Download PSEB 12th Result once announced.

    ReplyDelete
  54. http://www.schemehostport.com/2011/10/foundations-origin.html

    ReplyDelete
  55. A great app to help both your life becomes more convenient and comfortable. You can connect with friends or chat for free spoiled
    baixar whatsapp

    ReplyDelete
  56. When in love, there is not anybody want to give the one you love happy emotions, extreme happiness? But hey, if only for fun, out loud promises do not make promises. It's like you deliberately lit to others hoping to then go heartless beast was extinguished
    baixar musicas , geometry dash , baixar snapchat , run 2 , b612 app , retrica photo , slither.io

    ReplyDelete
  57. MPBSE Dept. soon issue the date of MP Board 12 Board Result 2017 & also Download CTET Result 2017 & those who want to download Rose Day 2017 Wall Paper Click here


    ReplyDelete

  58. The share your really gives us excitement. Thanks for your sharing. If you feel tired at work or study try to participate in our games to bring the most exciting feeling. Thank you!
    hotmail sign in | red ball game

    ReplyDelete
  59. We know that at the moment the phenomenon of increasing the proportion of insects in the Arab countries in general began and all this because of the rise in temperatures and high humidity in many areas bordering on the bodies of water,شركة رش مبيدات بخميس مشيط the insects and pests cause a lot of damage when you show up and be present in the home or any the origin of the work, and also shown no abundance in places where Misc food, and the problems caused by insects and pests in homes and other facilities which are diseases that afflict a resident of the house and a private back on children and lead to the presence of disease they have, and also found in the cupboards that store furniture and clothing and the incidence of their mold.شركة رش مبيدات بالطائف
    We all know the harmful insects but let's ask you more insects scattered far and pathogenic: flies, mosquitoes, fleas, ants, cockroaches and must be disposed of so as not to cause diseases in the residents of the house in order to ensure that the disease, especially in light of the spread of epidemics in the world and found harmful pests in high temperature areas.
    شركة تنظيف بخميس مشيط
    شركة تنظيف خزانات بخميس ميشط
    شركة كشف تسربات المياه بخميس مشيط
    شركة مكافحة حشرات بخميس مشيط
    شركة تنظيف منازل بخميس مشيط
    شركة نقل اثاث وعفش بخميس مشيط
    شركة تسليك مجارى بخميس مشيط

    ReplyDelete
  60. Wonderful blog! I found it while searching on Yahoo News. Do you have any suggestions on how to get listed in Yahoo News? I’ve been trying for a while but I never seem to get there! Many thanks.
    tanki online 3 | 2048 online

    ReplyDelete


  61. شركات نقل اثاث بالمدينة المنورة تساعدك على نقل اثاثك بامان فلا داعى للقلق مع شركات نقل اثاث بجدة

    عزيزى العميل انت من محبى التنقل باستمرار بالتالى انت بحاجة ماسة وضروية الى الاستعانة بالمختصين في نقل العفش خاصة شركات نقل اثاث بالرياض لان الاستعانة باى من عمالة الشوارع الغير مدربة والتي لا تمتلك خبرة كافية في نقل العفش او الحفاظ علية وليس هذا فقط فقد يؤدى الاستعانة بعمالة الشوارع الى حدوث حالة فقدان وتكسير للاثاث بالتالى التاثير الضار عليك عزيزى العميل

    لا تقلق مطلقاً الان بشأن نقل اي منقولات خاصة بك طالما استعنت بشركة الاول لـ نقل الأثاث في الرياض وخارج الرياض فنحن ليس الوحيدون ولكننا متميزون عن اى مؤسسة أخرى داخل وخارج الدمام وشهرتنا كافضل شركة نقل عفش بينبع
    نقل عفش بجدة

    ReplyDelete
  62. Your blog posts are more interesting and impressive. I think there are many people like and visit it regularly, including me.I actually appreciate your own position and I will be sure to come back here.
    facebook entrar

    ReplyDelete

  63. شركة نقل عفش واثاث بالدمام ابيات الشرقيه لخدمات نقل العفش والاثاث بالدمام
    شركة نقل عفش بالدمام
    نقل عفش بالخبر
    شركة نقل اثاث الدمام
    نقل عفش الدمام
    نقل عفش بالدمام
    ان اردت نقل عفش منزلك بالدمام ابيات الشرقية من اهم شركات نقل العفش بالدمام والخبر والجبيل والقطيف والاحساء

    ReplyDelete

  64. Wonderful blog! I found it while searching on Yahoo News. Do you have any suggestions on how to get listed in Yahoo News? I’ve been trying for a while but I never seem to get there! Many thanks.
    tanki online 3 | 2048 online

    ReplyDelete
  65. I am Nansy Sharma an Top Class Independent Escorts in Delhi, Escorts in Delhi, Escort Service in Delhi, We provide all types of female Delhi Escorts including Russian escorts, model escorts and independent escorts in Delhi for 24x7.
    Delhi Escorts
    Escorts in Delhi
    Independent Escorts in Delhi

    ReplyDelete

  66. The blog or and best that is extremely useful to keep I can share the ideas
    of the future as this is really what I was looking for, I am very comfortable and pleased to come here. Thank you very much.
    tanki online | 2048 game| tanki online game

    ReplyDelete
  67. While relocating, one simply needs to utilize the services of an effective moving organization and after that sit back. Moving services incorporate the extraordinary courses of action for moving pets. The pet darlings have a lot of stresses over the welfare of their pets while moving.
    Packers and Movers in Delhi
    Packers and Movers Delhi
    Movers and packers in Delhi
    Movers and packers Delhi

    ReplyDelete
  68. great article, I was very impressed about it, wish you would have stayed next share
    Facebook Lite

    ReplyDelete
  69. Chandigarh Call Girls (09988559083) Provide VIP Call Girl Service in Chandigarh, We have top class erotic Models of course beautiful Call girls in Chandigarh.

    Call Girls in Chandigarh

    Call Girls in Ludhiana

    Call Girls in Delhi

    Call Girls in Manali

    ReplyDelete

  70. The blog or and best that is extremely useful to keep I can share the ideas
    of the future as this is really what I was looking for, I am very comfortable and pleased to come here. Thank you very much.
    tanki online | 2048 game| tanki online game

    ReplyDelete
  71. Call +91-9988559083 to hire an independent Chandigarh Escort. We have huge collection VIP Indian and Russian escorts in Chandigarh.

    Chandigarh Escorts Service

    Manali Escorts Service

    Ludhiana Escorts Service

    Amritsar Escorts Service

    Delhi Escorts Service

    ReplyDelete
  72. When asked, everyone has a little selfish, a bit of ownership with his other half. For example do not want you to meet the opposite sex too much, do not want you to show intimate with someone, sometimes you do not have to re-charge regular love message calling them ... Sometimes that helps to love two you reheat your feelings, demonstrating that in his heart there is only him.
    facebook entrar

    ReplyDelete
  73. Chandigarh Call Girls (09988559083) Provide VIP Call Girl Service in Chandigarh, We have top class erotic Models of course beautiful Call girls in Chandigarh.

    Call Girls in Chandigarh
    Call Girls in Delhi
    Call Girls in Amritsar
    Call Girls in Manali

    ReplyDelete
  74. Hot and Sizzling 09988559083 girls are waiting for you. Don't miss the opportunity to spend the time with gorgeous Chandigarh Escort Service.

    Chandigarh Escort Service
    Manali Escort Service
    Amritsar Escort Service
    Ludhiana Escort Service

    ReplyDelete