Slippery SOP: Edge Cases in the Same Origin Policy

The talk asks why cross-site request forgery and cross-site scripting persist when browsers enforce the Same-Origin Policy, and maps the policy's edge cases without covering CORS. An origin is treated as scheme, host and port, and the policy allows embedding of images, scripts and stylesheets while blocking cross-site reads. Fetch and XHR requests are restricted to a few methods and content types, so strict JSON validation adds a useful layer against forged requests. Setting document.domain, by contrast, loosens the boundary across subdomains.

The middle section compares this with cookie scoping. Domain, path, Secure, HttpOnly and SameSite each isolate cookies differently, and cookies have no port-based isolation. A subdomain takeover can capture a parent-scoped session cookie or send forged requests that SameSite does not block, since the browser treats sibling subdomains as same-site. Early SameSite bypasses, browser quirks and Edge's exposure of applied CSS rules are noted as well.

The final part covers DNS rebinding, where a hostname moves from a public address to localhost mid-session. Firefox allowed the resulting read, while Chrome's Private Network Access blocked it, and certificate validation stops the attack in secure contexts. Burp Suite's former lack of TLS validation exposed internal HTTPS sites, a gap the vendor has begun to address in an early-adopter build. Practitioners should treat SameSite, tokens and content-type checks as layered defenses rather than complete fixes.