Website Policy & Configuration

Same Origin Policy (SOP)

• prevent document on one website from interacting with another website
• Origin: protocol, host, port
• provides isolation
• access prevented: cookies, DOM access, AJAX requests
• exception, where resource sharing is allowed: CORS, proxy server
• prevent data leakage, reduce malicious script impact
• Vulnerability:
  • excess permission on CORS (Access-Control-Allow-Origin: *)

Cross-Origin Resource Sharing (CORS)

• Purpose: Controls how web pages from one origin can request resources from another origin.
• How It Works: The server uses HTTP headers (like Access-Control-Allow-Origin) to specify allowed origins.

Content Security Policy (CSP)

• Purpose: Mitigates Cross-Site Scripting (XSS) and data injection attacks by restricting the resources a web page can load.
• How It Works: Developers specify allowed sources for content such as scripts, styles, and images using HTTP headers or <meta> tags.

HTTP Strict Transport Security (HSTS)

• Purpose: Enforces the use of HTTPS by ensuring that all communication between the browser and the server is encrypted.
• How It Works: The server sets an HTTP header, directing the browser to only use HTTPS for future requests to the domain.

SameSite Cookies

• Purpose: Prevents Cross-Site Request Forgery (CSRF) attacks by controlling when cookies are sent with requests.
• How It Works: Cookies are tagged with SameSite attributes (Strict or Lax) to limit cross-site behavior.

X-Content-Type-Options

• Purpose: Prevents browsers from interpreting files as a different MIME type than declared, reducing the risk of certain attacks like XSS.
• How It Works: The server sets this header to nosniff.

X-Frame-Options

• Purpose: Prevents Clickjacking attacks by controlling whether a web page can be displayed in a <frame> or <iframe>.
• How It Works: The server sets the X-Frame-Options header to DENY or SAMEORIGIN.

Sandbox Attribute

• Purpose: Isolates untrusted content within <iframe> elements to prevent it from interacting with the parent page.
• How It Works: Use the sandbox attribute to restrict capabilities such as script execution, form submission, and popups.

Referrer Policy

• Purpose: Controls how much referrer information is sent with requests, protecting sensitive data in URLs.
• How It Works: Use the Referrer-Policy header to specify rules.

References

MDN: HTTP headers MDN: Same-origin policy OWASP Secure Headers Project