Difference between revisions of "Same-origin policy"
Karl Jones (Talk | contribs) (→See also) |
Karl Jones (Talk | contribs) (→External links) |
||
| Line 33: | Line 33: | ||
* [http://en.wikipedia.org/wiki/Same-origin_policy Same-origin policy] @ Wikipedia | * [http://en.wikipedia.org/wiki/Same-origin_policy Same-origin policy] @ Wikipedia | ||
| + | |||
| + | [[Category:Computer science]] | ||
| + | [[Category:Internet security]] | ||
| + | [[Category:Web design and development]] | ||
Revision as of 15:54, 7 April 2016
In computing, the same-origin policy is an important concept in the web application security model.
Contents
Description
Under the policy, a web browser permits scripts contained in a first web page to access data in a second web page, but only if both web pages have the same origin.
An origin is defined as a combination of URI scheme, hostname, and port number.
This policy prevents a malicious script on one page from obtaining access to sensitive data on another web page through that page's Document Object Model.
Cookies
This mechanism bears a particular significance for modern web applications that extensively depend on HTTP cookies to maintain authenticated user sessions, as servers act based on the HTTP cookie information to reveal sensitive information or take state-changing actions.
A strict separation between content provided by unrelated sites must be maintained on the client side to prevent the loss of data confidentiality or integrity.
See also
- Ajax (programming)
- Client-side scripting
- Computer security
- Cross-site scripting
- Document Object Model
- Domain Name System
- Web application
- Web browser
- Web security
- Web service
External links
- Same-origin policy @ Wikipedia
