Saturday, October 1, 2011

Foundations: Origin

Every discussion of the security architecture of the web platform should begin with the notion of an origin.  An origin is the basic unit of isolation in the web platform.  Every object in the browser is associated with an origin, which defines its security context.  When a script running in one origin tries to access an object, the browser checks whether the script's origin has access to the object's origin.

So what is an origin?  Simply put, an origin is the scheme, host, and port of the URL associated with the object.  (Hence the name of this blog.)  For example, if you're viewing an article on New York Times in your browser, that article (and all of its associated objects) are in the http://www.nytimes.com origin.  This blog exists in the http://www.schemehostport.com origin, which means there is a security boundary between this blog and the New York Times.  Of course, there are many subtleties to that security boundary, which we'll get to in due course.

Many folks have written about the browser's origin-based security model, which is often referred to as the same-origin policy because, in the usual case, the browser allows one object to access another if the two objects are in "the same" origin.

If you'd like to learn more about the same-origin policy, one popular reference is Jesse Ruderman's wiki page, but, despite origin's central role in web security, there isn't a specification explaining how the same-origin policy works!  To fix that, I've been working with the IETF's websec working group to write a specification of the web origin concept.  There are still a handful of issues to address, but hopefully finish working through the IETF process soon.

999 comments:

  1. Once you get past the high level, the most thorough public description of the many different 'definitions' of SOP that I am aware of is from Michal Zalewski's browser security document:
    http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy

    It's possible that some points there might be out of date, but I don't know that anyone is keeping track closely.

    Notably, that document shows that even a specification containing a straightforward formulation of the SOP will not have all major browsers in compliance (and I doubt that will change). Also, there will remain important differences in the details of how it is applied.

    ReplyDelete
  2. The topic of this blog is just fantastic, the blog is quite informative too. Thanks for posting!
    Supernatural Jacket

    ReplyDelete
  3. This comment has been removed by the author.

    ReplyDelete
  4. This is a great post ! it was very informative. I look forward in reading more of your work. Also, I made sure to bookmark your website so I can come back later. I enjoyed every moment of reading it.
    baju batik modern baju batik baju batik wanita batik pekalongan batik couple batik online batik modern gamis batik

    ReplyDelete
  5. Great blog here with all of the valuable information you have. Keep up the good work you are doing here.
    Black magic to get your love back

    ReplyDelete
  6. This is great do you have a catologue if so I would love one to share with friends and family.
    Bookmyshow T20 Cricket World Cup Tickets Buy
    ICC T20 World Cup 2016 Qualifier Venues Groups

    ReplyDelete
  7. What solid post this is for me and usually posts some really exciting stuff like this.We, Arabia wasj Co.Ltd.,are working as one team since years, we do aspire to become the pioneers and characteristic in the field of contracting as we lways keen to attract best administrative and technical capabalities with highly acclaimed expertise with success to fit together in one complete group able to carry out large projects. شركة وسج العربية

    ReplyDelete
  8. After study a few of the blog posts on your website now, and I truly like your way of

    blogging.Steel boned corsets can reduce your waist line by 4-5 inches,silhouette

    (examples: hourglass, conical, s-curve) of corset that is best for everyone.Wholesale

    Price,Best Quality.http://www.latexcorsets.com/steel-boned-corsets-c-200.html

    ReplyDelete
  9. Hey guys!! also check the all latest updates of Vivo IPL t20 2016 live streaming-

    Vivo ipl t20 live on Sony Max

    ReplyDelete
  10. It is the best time to make plans for the future and it's time to be happy. I have read this post and if I could I wish to suggest you few interesting things or advice. Maybe you could write next articles referring to this article. I want to read even more things about it!
    http://www.friv30game.com/
    http://www.friv2gamers.com/
    http://www.denygiochi.it/
    http://www.denyjeux.fr/

    ReplyDelete
  11. http://www.movies-out.com/2016/03/tom-hanks-acts-out-his-movies-in-six-minutes.html
    http://www.movies-out.com/2016/03/batman-vs-superman-who-is-better.html

    ReplyDelete
  12. You’ve written nice post, I am gonna bookmark this page, thanks for info. I actually appreciate your own position and I will be sure to come back here.
    mortal kombat x, a10, roblox, color switch

    ReplyDelete
  13. Very useful post. This is my first time i visit here. I found so many interesting stuff in your blog especially its discussion. Really its great article. Keep it up!
    cat mario
    clicker heroes
    cubefield
    curve fever
    dragon ball z devolution
    duck life
    gun mayhem 2

    ReplyDelete
  14. vashikaran specialist in ghaziabad
    nice post keep sharing

    ReplyDelete
  15. Let’s keep out sites for your child! click:
    brain games | puzzle games | tetris | happy wheels | agario | abcya | fnaf 4 | super mario games
    To play for free!

    ReplyDelete
  16. Thanks for this info. Keep up the neat work. I'll be returning often thanks for sharing...
    Got Release Date in UK USA Australia
    Watch Got with English Subtitles

    ReplyDelete
  17. Replies
    1. To quickly to receive the best who can give you an unforgettable evening. We work only with meticulously selected Jaipur call girls Noor ladies who quickly in your pink city Jaipur.

      Delete
  18. This comment has been removed by the author.

    ReplyDelete
  19. i have seen your article really i like it thanks for sharing it .

    Escorts jaipur

    Escorts dehradun

    ReplyDelete
  20. The best space for your child to relax!: wingsio
    slither io

    ReplyDelete
  21. Let’s keep are safe place to play the very best free games for kids! Please click:
    slither.io | wings.io | happy wheels | abcya | fnaf 4 to play for free!

    ReplyDelete

  22. http://www.15aug2016images.in/2016/07/15-august-swatantrata-diwas-2016-images.html
    http://www.15aug2016images.in/2016/07/15-august-70th-independence-day-2016-3d.html
    http://www.15aug2016images.in/2016/07/15-august-2016-modi-speech-live-images.html
    http://www.15aug2016images.in/2016/07/15-august-2016-national-anthem-song.html
    http://www.15aug2016images.in/2016/07/15-august-2016-tringa-images-tri-colour.html
    http://www.15aug2016images.in/2016/07/15-august-2016-bollywood-songs-mp3-list.html
    http://www.15aug2016images.in/2016/07/15-august-2016-patriotic-poems-kavita.html
    http://www.15aug2016images.in/2016/07/70th-independence-day-15-august-2016.html
    http://www.15aug2016images.in/2016/07/15-august-2016-facebook-profile-pics-dp.html
    http://www.15aug2016images.in/2016/07/15-august-2016-status-thoughts-quotes.html
    http://www.15aug2016images.in/2016/07/15-august-2016-fb-cover-images-pics.html
    http://titfortat.in/15-august-2016-speech/happy-70th-independence-day-2016-images-1200/
    http://titfortat.in/15-august-2016-speech/15-august-70th-independence-day-2016-fb-profile-pics-1203/
    http://titfortat.in/15-august-2016-speech/15-august-2016-desh-bhakti-kavita-1189/
    http://titfortat.in/15-august-2016-speech/15-august-2016-anchoring-script-speech-1173/
    http://titfortat.in/festivals/swatantrata-diwas-2016-sms-1249/
    http://titfortat.in/festivals/swatantrata-diwas-2016-images-1243/

    ReplyDelete
  23. this is one of the cult game now, a lot of people enjoy playing them . Also you can refer to the game :
    age of war | red ball | earn to die 5 | Tank trouble | happy wheels | earn to die 6
    The game controls are shown just under . Movement mechanisms primarily include acceleration and tilting controls.
    tank trouble unblocked | wings io | strike force heroes | age of war | hotmail login

    ReplyDelete
  24. Goa Escort

    In today's dynamic world, the Call Girls are having impact as far as amusement industry where clients are attracted by an adorable desire given by these young ladies. Above all else guests coming to India will settle available to come back to work young ladies to serve their requirements which increases the value of their visit to goa. With the blasting number of guests accessible if the need arises young ladies organizing sites is going to build step by step. In the long run increasingly Call Girls, goa Escort Services and goa Female Escorts are coming into operations ordinary and contracting fresher and experienced Call Girls left and right.

    Goa Female Escort

    ReplyDelete
  25. Call us O98157273O2 Jalandhar Escorts are classified as the cautiously selected couple of college your current unlimited fantasies.Take Support inside jalandhar present companies not merely inside jalandhar although anywhere in Of india.
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    Call Girl In Jalandhar Prince O98157273O2 High Profile Jalandhar Call Girl
    Call Girl In Jalandhar Prince O98157273O2 High Profile Jalandhar Call Girl
    Call Girl In Jalandhar Prince O98157273O2 High Profile Jalandhar Call Girl
    Call Girl In Jalandhar Prince O98157273O2 High Profile Jalandhar Call Girl
    Call Girl In Jalandhar Prince O98157273O2 High Profile Jalandhar Call Girl
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/
    http://www.princemodelschandigarh.in/

    ReplyDelete
  26. I was working and suddenly I visits your site frequently and recommended it to me to read also. Age Of War 2
    Big Farm | Slitherio
    Tank Trouble | Happy Wheels
    Goodgeme Empire | Slither.io

    ReplyDelete
  27. The blog or and best that is extremely useful to keep I can share the ideas
    of the future as this is really what I was looking for, I am very comfortable and pleased to come here. Thank you very much.
    gold miner|stick war 3| pokemongo
    | stick man|animal jam login

    ReplyDelete
  28. Great! Thanks for sharing the information. That is very helpful for increasing my knowledge in this field.
    subway surfers | run 3 | Click jogos| temple run 2| fnaf sister location | juegos gratis | juegos de futbol

    ReplyDelete
  29. No more longing to become renowned at present. Buy Facebook Followers as a way to get fame and acceptance online in a shorter duration. increase facebook followers

    ReplyDelete

  30. Our Dolphins Flag is constructed of polyester, measures 3x5 feet, and has two metal grommets for attaching to a traditional flagpole, tailgate pole, or our 6' aluminum flagpole. The perimeter of our Dolphins Flag is double stitched and the Officially Licensed NFL Miami Dolphins team logos are dye sublimated into the flag so they won't peel. Due to its large size, this flag is also perfect to hang in your game room, sports room, office, or kids room.
    sports flags,
    nfl flags wholesale,New England Patriots stars and stripes flags
    cheap New Orleans Saints american banners

    ReplyDelete
  31. Il nuovo maglia di casa Roma 16-17 introduce un design sobrio. Realizzato da Nike e non con eventuali loghi degli sponsor per il momento, la maglia della Roma 2016-17 è stato rilasciato il 6 luglio 2016.maglie calcio poco prezzo,
    maglie da calcio a poco prezzo, Maglia real madrid a poco prezzo 2017
    nuove Maglia Atletico Madrid prezzo

    ReplyDelete
  32. This blog is so nice to me. I will continue to come here again and again. Visit my link as well. Good luck
    temple run 2

    ReplyDelete
  33. Thanks for sharing information it is very helpful for and informative thanks again admin I hope you will share some posts again
    www.indbabes.in

    ReplyDelete
  34. Avoid longing to get famed these days. Buy Facebook Followers as a strategy to get fame and authority online in a small span. buy facebook followers

    ReplyDelete
  35. Thank you for your post, I look for such article along time, today i find it finally. this post give me lots of advise it is very useful for me
    wings.io | supermechs | wingsio | wingsio game | super mechs | wingsio | super mechs 2 | wingsio game

    ReplyDelete
  36. This winter I'll tell him, with great things. If we were young, and we belong to each other, why not take advantage of these days?
    geometry dash 2.0 , geometry dash , geometry dash 2.0 apk , geometry dash apk , geometry dash online

    ReplyDelete
  37. When the influx of capital and go outside, will more than to have someone to think about. And not the dark house lies waiting, by a person under the porch waiting before. I'm not sure who it was you
    run 2 , run 2 game , run , play run 2 , run 3

    ReplyDelete
  38. Escort in Gurgaon is a new world phenomenon for people who like to have fun in a safe way and for people who are away for home. Escorts relax you in a very healthy way and allow you to spend quality time in the company of educated beautiful girls . Escorts in Gurgaon

    ReplyDelete
  39. Thank you for such a sweet tutorial - all this time later, I've found it and love the end result. I appreciate the time you spent sharing your skills.
    wingsio | super mechs | wingsio play | supermechs | wingsio game | super mechs 2

    ReplyDelete
  40. Every has been chosen for not solely their exceptional beauty except for being open minded and versatile. We have a tendency to specialise in providing the simplest vary of elite escorts from round the world. every and each one in every of our horny models has been chosen not just for her good charm and exotic beauty, Escorts in Gurgaon

    ReplyDelete

  41. I wanted to thank you for this excellent read!! I definitely loved every little bit of it.Cheers for the info!!!! & This is the perfect blog for anyone who wants to know about this topic
    return man , subway surfers , hola launcher , pokemon go , minecraft

    ReplyDelete
  42. I would like more information about this, because it is very nice. Thanks for sharing. Game return man play the football game for free. The game return man 3 you like it? I like play game as Stick RPG and game Potty Racers 3

    ReplyDelete
  43. Happy happy new year.Have a best and happy new year.
    Celibrate with wishes to others eg friends, parents, brothers and relatives.
    To bring close them with yourself.
    Best New Year SMS 2017
    New Year 2017 Wishes

    ReplyDelete
  44. Pipeline leak detection is used to determine if and in some cases where a leak has occurred in systems which contain liquids and gases. Methods of detection include hydrostatic testing, infrared, and laser technology after pipeline erection and leak detection during service.
    عزل اسطح بالمدينة المنورة
    شركة عزل الاسطح بالرياض
    تسليك مجاري بالدمام
    تسليك مجاري بالرياض
    جلى بلاط بالرياض

    ReplyDelete
  45. Nice information. Thanks for sharing this article. It helps me much :) Please keep sharing us the latest information
    run 2 game | atari breakout | supermechs| wingsio | super mechs | wingsio game | super mechs 2

    ReplyDelete
  46. Life after hours of work stress and fatigue is the space I really love. I can play games, take photos or simply surfing facebook, chatting with friends. It made me feel so comfortable and pleasan

    baixar facebook , geometry dash , run 2 , strike force heroes 2 , square quick

    ReplyDelete
  47. Packers and movers in Gurgaon
    Movers and packers in Gurgaon
    Packers and movers Gurgaon
    Movers and packers Gurgaon
    http://www.multipackersmovers.in/packers-and-movers-in-gurgaon/
    http://www.multipackersmovers.in/packers-and-movers-in-pune/

    ReplyDelete
  48. New Year is the best event for everyone so celebrate this New Year 2017 with us and send some wonderful and awesome New Year Wishes, Greeting, Quotes and many more for your Love ones.
    New Year Wishes 2017
    New Year Wishes 2017

    ReplyDelete
  49. MPBSE Dept. soon issue the date of MP Board 12 Board Result 2017 & also Download CTET Result 20177 & those who want to download Valentines Day 2017 Wall Paper Click here

    ReplyDelete
  50. Punjab Education Board will be going to issues out PSEB 10th Result 2017 in the month of May, 2017 for all of you. Check & Download PSEB 12th Result once announced.

    ReplyDelete
  51. http://www.schemehostport.com/2011/10/foundations-origin.html

    ReplyDelete
  52. A great app to help both your life becomes more convenient and comfortable. You can connect with friends or chat for free spoiled
    baixar whatsapp

    ReplyDelete
  53. When in love, there is not anybody want to give the one you love happy emotions, extreme happiness? But hey, if only for fun, out loud promises do not make promises. It's like you deliberately lit to others hoping to then go heartless beast was extinguished
    baixar musicas , geometry dash , baixar snapchat , run 2 , b612 app , retrica photo , slither.io

    ReplyDelete
  54. MPBSE Dept. soon issue the date of MP Board 12 Board Result 2017 & also Download CTET Result 2017 & those who want to download Rose Day 2017 Wall Paper Click here


    ReplyDelete
  55. We know that at the moment the phenomenon of increasing the proportion of insects in the Arab countries in general began and all this because of the rise in temperatures and high humidity in many areas bordering on the bodies of water,شركة رش مبيدات بخميس مشيط the insects and pests cause a lot of damage when you show up and be present in the home or any the origin of the work, and also shown no abundance in places where Misc food, and the problems caused by insects and pests in homes and other facilities which are diseases that afflict a resident of the house and a private back on children and lead to the presence of disease they have, and also found in the cupboards that store furniture and clothing and the incidence of their mold.شركة رش مبيدات بالطائف
    We all know the harmful insects but let's ask you more insects scattered far and pathogenic: flies, mosquitoes, fleas, ants, cockroaches and must be disposed of so as not to cause diseases in the residents of the house in order to ensure that the disease, especially in light of the spread of epidemics in the world and found harmful pests in high temperature areas.
    شركة تنظيف بخميس مشيط
    شركة تنظيف خزانات بخميس ميشط
    شركة كشف تسربات المياه بخميس مشيط
    شركة مكافحة حشرات بخميس مشيط
    شركة تنظيف منازل بخميس مشيط
    شركة نقل اثاث وعفش بخميس مشيط
    شركة تسليك مجارى بخميس مشيط

    ReplyDelete
  56. Your blog posts are more interesting and impressive. I think there are many people like and visit it regularly, including me.I actually appreciate your own position and I will be sure to come back here.
    facebook entrar

    ReplyDelete

  57. Wonderful blog! I found it while searching on Yahoo News. Do you have any suggestions on how to get listed in Yahoo News? I’ve been trying for a while but I never seem to get there! Many thanks.
    tanki online 3 | 2048 online

    ReplyDelete
  58. I am Nansy Sharma an Top Class Independent Escorts in Delhi, Escorts in Delhi, Escort Service in Delhi, We provide all types of female Delhi Escorts including Russian escorts, model escorts and independent escorts in Delhi for 24x7.
    Delhi Escorts
    Escorts in Delhi
    Independent Escorts in Delhi

    ReplyDelete

  59. The blog or and best that is extremely useful to keep I can share the ideas
    of the future as this is really what I was looking for, I am very comfortable and pleased to come here. Thank you very much.
    tanki online | 2048 game| tanki online game

    ReplyDelete
  60. While relocating, one simply needs to utilize the services of an effective moving organization and after that sit back. Moving services incorporate the extraordinary courses of action for moving pets. The pet darlings have a lot of stresses over the welfare of their pets while moving.
    Packers and Movers in Delhi
    Packers and Movers Delhi
    Movers and packers in Delhi
    Movers and packers Delhi

    ReplyDelete
  61. great article, I was very impressed about it, wish you would have stayed next share
    Facebook Lite

    ReplyDelete
  62. Chandigarh Call Girls (09988559083) Provide VIP Call Girl Service in Chandigarh, We have top class erotic Models of course beautiful Call girls in Chandigarh.

    Call Girls in Chandigarh

    Call Girls in Ludhiana

    Call Girls in Delhi

    Call Girls in Manali

    ReplyDelete

  63. The blog or and best that is extremely useful to keep I can share the ideas
    of the future as this is really what I was looking for, I am very comfortable and pleased to come here. Thank you very much.
    tanki online | 2048 game| tanki online game

    ReplyDelete
  64. Call +91-9988559083 to hire an independent Chandigarh Escort. We have huge collection VIP Indian and Russian escorts in Chandigarh.

    Chandigarh Escorts Service

    Manali Escorts Service

    Ludhiana Escorts Service

    Amritsar Escorts Service

    Delhi Escorts Service

    ReplyDelete
  65. When asked, everyone has a little selfish, a bit of ownership with his other half. For example do not want you to meet the opposite sex too much, do not want you to show intimate with someone, sometimes you do not have to re-charge regular love message calling them ... Sometimes that helps to love two you reheat your feelings, demonstrating that in his heart there is only him.
    facebook entrar

    ReplyDelete
  66. Chandigarh Call Girls (09988559083) Provide VIP Call Girl Service in Chandigarh, We have top class erotic Models of course beautiful Call girls in Chandigarh.

    Call Girls in Chandigarh
    Call Girls in Delhi
    Call Girls in Amritsar
    Call Girls in Manali

    ReplyDelete
  67. Hot and Sizzling 09988559083 girls are waiting for you. Don't miss the opportunity to spend the time with gorgeous Chandigarh Escort Service.

    Chandigarh Escort Service
    Manali Escort Service
    Amritsar Escort Service
    Ludhiana Escort Service

    ReplyDelete
  68. Call Girls in Jalandhar 09988559083 Girls Independent Jalandhar Escorts for Jalandhar Escorts Services. We are offer world class Call Girls in Jalandhar.

    Escort in Jalandhar
    Escort in Delhi
    Escort in Manali
    Escort in Amritsar

    ReplyDelete
  69. 24 Hour Chandigarh Escorts, Call us on (+91 9988559083) Chandigarh Escort Service, Chandigarh Independent Escorts, Chandigarh VIP Escorts, Chandigarh Call Girls.

    Chandigarh Escort Service
    Amritsar Escort Service
    Delhi Escort Service
    Manali Escort Service

    ReplyDelete

  70. Every one of our models is peasant and charming; some of them offer national services as Travel Delhi Escorts Service

    ReplyDelete
  71. so they can fly off you with appropriate notification. The others girls are situated in above all exotic places and cities in India. The escorts of our agency are agreeable in the high society and are ideal for open or private bash. Escorts Service in Delhi

    ReplyDelete
  72. A great app to help both your life becomes more convenient and comfortable. You can connect with friends or chat for free spoiled
    whatsapp baixar
    Square Quick
    Geometry Dash
    Baixar Musicas
    Snapchat

    ReplyDelete
  73. Life becomes more interesting and wonderful when you share your memorable moments with friends and family through unique photographs. You can create your own unique style impressed with image editing software. And after hours of work stress you can also

    dream league soccer
    subway surfer
    clash royale
    go launcher
    banana kong

    ReplyDelete
  74. When is Gujarat Board SSC Class Results 2017 coming out? Please tell me when Gujarat board will declare results for class 10. I am waiting for my results and I want its soon.

    ReplyDelete
  75. We have stunning wonderful Gurgaon escorts to suit everybody for each event. Our high class adult entertainment service offers quality allies around Gurgaon. If you want to be surrounded by the vicinity of delightful and tasteful Gurgaon Escorts

    ReplyDelete

  76. you have arrived to the ideal spot. We are best and cheap escort Agency in Gurgaon, who can provide best in class escorts services. Our delightful organization is the best that you will discover anyplace and will give you awesome client satisfaction. Finding the right woman, paying little respect to the event, Escorts in Gurgaon

    ReplyDelete