Thread by @sec_r0

#Learn365 - Day 4⃣

SOP 🫧, Same Origin Policy.
A browser security framework that every #hacker should know.

Know what is it in this thread 🧵👇

#infosec #security #appsec #cybersecurity #SOP #http

SOP is browser security model, and I find lot of folks out there, who still dont understand it in and out.
Let me cover it here, in few threads.

Let's Start.

It is a browser security model 🔥. Now what does that means ?
It simply means this control is enforced by browser to make user visiting a site more secure from attackers.

Browser creates virtual boundaries to segregate sites and this boundary is identified with ORIGINS.

ORIGIN is combination of Protocol + WebAddress + Port

i.e : securityzines.com:8080 this entire string will be treated as part of origin.

On the other hand. securityzines.com:8080 will become completely different Origin from browser's perspective bcz of protocol change.

If there are two request originating for same Origin, browser will share cookies across. That's how it is. Be it from any domain.

But will block the RESPONSE based on response headers.

And this block happens because of SOP.

An amazing thing to note here is that, Browser wont block the request !!! 🚨

IT SIMPLY WONT.

It will let the request pass by. By will take action on RESPONSE.

Why ?
Because of lot of reasons, may be I will cover them up later someday.

BUT BUT BUT...

Browser is not that restrictive.

It will show curtesy if there are few HEADERS present in response from server.

& That is going to be our next day topic. CORS HEADERS.

If you want to know more about this topic, then I have a very good ZINE on it. securityzines.com/zines/sop.html

I have used the most simplest explanations ever to make you understand this topic. Do check it out.

If you like this thread, consider RTing and follow @sec_r0 for more of such threads.