3 added 11 characters in body
source | link

It protects the legitimacy of the interaction between the user and the "original" website from malicious Javascript executed on the "other origin."

Suppose I am logged into a super-secret admin portal A. I've finished doing my admin work, so I decide to go off browsing and find myself on dodgy website B.

Dodgy website B executes some javascript that attempts to fetch some privileged data from A and ferry it off to a third party.

Enter Same Origin Policy. With the Same Origin Policy, the browser won't allow javascript to access that information.

And yes, the browser could simply not implement the Same Origin Policy, or the user could disable it, but that is not something that the dodgy folk over at Website B have control over.

It protects the legitimacy of the interaction between the user and the "original" website from malicious Javascript executed on the "other origin."

Suppose I am logged into a super-secret admin portal A. I've finished doing my admin work, so I decide to go off browsing and find myself on dodgy website B.

Dodgy website B executes some javascript that attempts to fetch some privileged data ferry it off to a third party.

Enter Same Origin Policy. With the Same Origin Policy, the browser won't allow javascript to access that information.

And yes, the browser could simply not implement the Same Origin Policy, or the user could disable it, but that is not something that the dodgy folk over at Website B have control over.

It protects the legitimacy of the interaction between the user and the "original" website from malicious Javascript executed on the "other origin."

Suppose I am logged into a super-secret admin portal A. I've finished doing my admin work, so I decide to go off browsing and find myself on dodgy website B.

Dodgy website B executes some javascript that attempts to fetch some privileged data from A and ferry it off to a third party.

Enter Same Origin Policy. With the Same Origin Policy, the browser won't allow javascript to access that information.

And yes, the browser could simply not implement the Same Origin Policy, or the user could disable it, but that is not something that the dodgy folk over at Website B have control over.

2 deleted 143 characters in body
source | link

It protects the legitimacy of the interaction between the user and the "original" website from malicious Javascript executed on the "other origin."

Suppose I am logged into a super-secret admin portal A. I've finished doing my admin work, so I decide to go off browsing and find myself on dodgy website B.

Dodgy website B executes some javascript that attempts to performfetch some privileged action against a URL on A and, lo and behold,data ferry it off goes my session cookie and the next thing you know you've started World War 3to a third party.

Enter Same Origin Policy. With the Same Origin Policy, the browser won't allow that cross-domain AJAX requestjavascript to be made. No nukes are fired. Disaster avertedaccess that information.

And yes, the browser could simply not implement the Same Origin Policy, or the user could disable it, but that is not something that the dodgy warmongersfolk over at Website B have control over.

It protects the legitimacy of the interaction between the user and the "original" website from malicious Javascript executed on the "other origin."

Suppose I am logged into a super-secret admin portal A. I've finished doing my admin work, so I decide to go off browsing and find myself on dodgy website B.

Dodgy website B executes some javascript that attempts to perform some privileged action against a URL on A and, lo and behold, off goes my session cookie and the next thing you know you've started World War 3.

Enter Same Origin Policy. With the Same Origin Policy, the browser won't allow that cross-domain AJAX request to be made. No nukes are fired. Disaster averted.

And yes, the browser could simply not implement the Same Origin Policy, or the user could disable it, but that is not something that the dodgy warmongers over at Website B have control over.

It protects the legitimacy of the interaction between the user and the "original" website from malicious Javascript executed on the "other origin."

Suppose I am logged into a super-secret admin portal A. I've finished doing my admin work, so I decide to go off browsing and find myself on dodgy website B.

Dodgy website B executes some javascript that attempts to fetch some privileged data ferry it off to a third party.

Enter Same Origin Policy. With the Same Origin Policy, the browser won't allow javascript to access that information.

And yes, the browser could simply not implement the Same Origin Policy, or the user could disable it, but that is not something that the dodgy folk over at Website B have control over.

1
source | link

It protects the legitimacy of the interaction between the user and the "original" website from malicious Javascript executed on the "other origin."

Suppose I am logged into a super-secret admin portal A. I've finished doing my admin work, so I decide to go off browsing and find myself on dodgy website B.

Dodgy website B executes some javascript that attempts to perform some privileged action against a URL on A and, lo and behold, off goes my session cookie and the next thing you know you've started World War 3.

Enter Same Origin Policy. With the Same Origin Policy, the browser won't allow that cross-domain AJAX request to be made. No nukes are fired. Disaster averted.

And yes, the browser could simply not implement the Same Origin Policy, or the user could disable it, but that is not something that the dodgy warmongers over at Website B have control over.