As I understand the "Same Origin Policy" is a browser security feature that aims to protect the user. It prevents scripts to load data from another webserver (typicall with ajax).
So esentially there are 3 actors:
- The User in the Browser
- The Original Website
- The "other origin" Web Resource
Does it protect the user ? No: With CORS I can just allow any Origin on a malicious "Other origin" Web Resource
Does it protect the original Website? No: With CORS I can just allow any Origin on a malicious "Other origin" Web Resource
Does it protect the "other origin" Web Resource? No: A browser with Same Origin Policy disabled or a crafted request can be used to get the request trough anyway
I cannot get my head around that. What is the situation where the SOP help and which of these 3 actors does it protect in this situation.