4

Same Origin Policy does not prevent origin foo.bar from creating a form with action attribute set to another origin baz.duh and even allows to programmatically submit this form without the user knowing through untrusted events originating via JavaScript just by loading the page. To solve this issue, programmers are forced to use CSRF tokens.

If AJAX requests originating from XMLHttpRequest and canvas objects are subject to Same Origin Policy and not allowed to access the response, why aren't form submissions/XHR requests simply disallowed? What is the reasoning behind this allowance?

I know endpoints accepting the GET request method can be exploited by images as well, but this question is about POST and similar method forms only. Wouldn't the need of CSRF tokens vanish if SOP didn't permit cross-origin form submission? What purpose does cross-origin form submission serve?

1

The Same Origin Policy protects the client. CSRF tokens protect the server.

SOP prevents malicious site A from accessing cookie credentials held by the client for site B which would otherwise be submitted along with the cross-origin request. See How do web servers enforce the same-origin policy? (short answer: they don't)

The link in the other answer states:

While prevention of cross-origin writes would mitigate entire classes of web security vulnerabilities (CSRF, XSS, etc), the web is a far richer platform because some forms of Cross-Origin Writes are permitted in most cases.

In particular, things like OpenID and quite a lot of credit card processing systems make use of the ability to pass state from one domain's system to another. So banning all cross-origin HTTP would be seriously limiting. Therefore an alternative mechanism is needed. CSRF tokens prove that whatever's sending the HTTP request (remember, not necessarily a browser at all!) got the authorization token from a web page that the server previously emitted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.