Same-Origin Policy: Evaluation in Modern Browsers
summary
Evaluates Same‑Origin Policy behavior across modern browsers by running 544 test cases against 10 major browsers with an online testbed that reports read, write and execute rights for each embedding element; finds access depends on embedding element, sandbox and CORS and reports 23% differing behavior across browsers; discovers many CORS and element-specific inconsistencies, large canvas/CSS differences, and IE/Edge issues acknowledged by Microsoft (MSRC Case 32703).
AI-written summary · about
chapters (11)
- 0:00Intro
- 1:28Same-Origin Policy
- 4:29Different Subsets Of SOP Rules
- 6:46Scalable Vector Graphics
- 7:54Research Questions
- 9:11SOP-DOM Setup: Test Cases
- 15:29Different Browser Behaviors
- 19:32Cross-Origin Login Oracle Attack
- 21:27Limitations
- 22:39Access Control Policies
- 24:22Conclusions & Future Work
related talks
28mBypassing Same-Origin Policy
27mCode-Origin Policy: Towards a Formal User Privacy Protection for the Web
59mThe Final Frontier: Security APIs in Modern Browsers
36mHTML5 JS Security
32mJavaScript security: a retrospective
40mMisconfigured CORS and why web appsec is not getting easier
44mIFRAME
24mWe're struggling to keep up