search

cs161-staff / textbook

Online textbook for CS 161: Computer Security at UC Berkeley.
https://textbook.cs161.org/
68 stars 23 forks source link

Fix Same Origin Policy (SOP) #19

Open fuzailshakir opened 2 years ago

fuzailshakir commented 2 years ago

Rework SOP to make it correct(?) -- the ideas about tabs are incorrect

julien-piet commented 2 months ago

The current version of the SOP page doesn't discuss tabs. Is this still relevant?

The current version seems correct. In my understanding, the SOP is implementation agnostic, it isolates two webpages from accessing each other if they do not share the same origin. This is true regardless of if these webpages are embedded on the same webpage or in separate tabs. Tabs are run in separate processes which naturally enforces SOP, but one could imagine implementing this differently. Maybe there are primitives I am not aware of that allow communication between tabs in a way that violates SOP ?