What is the same-origin policy, and how can you get around it?

1. unlocking the secrets

3. don't make cross-origin requests

5. Protection for server
Protection for clients

6. Netscape days
RFC 6454 - 1999?
6454 6454

7. All browsers:
javascript
*java
*flash

8. There's IE, and then there's everyone else...

10. <script src="..."/>
<img/video src="..."/>
<a href="..."/>
form submission
iframe embedded pages

12. Javascript cannot be used to access most iframe properties/content
e.g.: banking app w/ ads

13. HTML5 Web Messaging (window.postMessage)

14. Web Messaging (traditional endpoint)
303 redirect (S3 endpoint)

15. Javascript access to properties, and the ability to export.
e.g. modifying an image & caching it

16. 1. crossorigin attribute & Access-Control-Allow-Origin header (CORS)
2. Proxying

17. *Browsers will simply not send any cross-origin request
e.g. mini-stackoverflow

18. CORS spec
JSONP

20. Allows for cross-origin ajax requests:
servers must opt-in
full support in all modern browsers
IE9/8 have partial support
no support for IE7 & older

21. XMLHttpRequest
methods: GET, POST, HEAD
headers: Accept, Accept-Language, Content-Language, Content-Type
Content-Type: text/plain, application/x-www-form-urlencoded,
multipart/form-data
request includes an Origin header
response must include an Access-Control-Allow-Origin header
response optionally includes Access-Control-Expose-Headers

22. XDomainRequest
IE 8-9
methods: GET, POST, HEAD
cannot send ANY headers!
request includes an Origin header
response must include an Access-Control-Allow-Origin header
no access to response headers
no access to response status

23. browser-preflighted XMLHttpRequest
methods: DELETE, PUT
or GET/POST w/ non-simple headers or Content-Type
browser "preflights" request (OPTIONS) w/ Origin, Access-Control-
Request-Method, & Access-Control-Request-Headers headers
server must respond with Access-Control-Allow-Origin, Access-Control-
Allow-Methods, & Access-Control-Allow-Headers headers
browser then sends the original request w/ Origin header
server must respond w/ Access-Control-Allow-Origin header

24. Not supported, but workarounds available for some cases:
DELETE/PUT method -> POST w/ _method param

25. XDomain iframe library