Question

I have a confusion about the Same Origin Policy(SOP).

For example, http://bad.com/bad.html with a bad.js , and http://good.com/good.html with a good.js . I open both urls in my chrome with two tabs(tab1, and tab2).

In the good.html(opened in tab2), there is a element <input id="token-id" type='text' name='token' value='123abc'>

Now the question is if there is no SOP , whether it's possible to read the element input value from bad.html(opened in tab1) with some code like document.getElementById('token-id').value() in bad.js .

Another question is if the above question's answer is 'no' , I can't understand this sentence in wiki https://en.wikipedia.org/wiki/Same-origin_policy#Security_Concerns .

Regarding the sending of new transactions, even CSRF protections by the banking site have no effect, because the script can simply do the same as the user would do

As we can't get the csrf token. why it does't work. Server can figure the real post request by verify the csrf token.

Do I misunderstand the csrf protection or the SOP itself?

Thanks if anyone can help me figure out these confusion.

Answer 1

Now the question is if there is no SOP, whether it's possible to read the element input value from bad.html(opened in tab1) with some code like document.getElementById('token-id').value() in bad.js.

No — since there is no reference to the other tab.

If the tab being read from was opened via window.open from the tab doing the reading (instead of manually), then the token could be read.

Happily, the Same Origin Policy does exist, so we don't need to worry about that.

---

Regarding the sending of new transactions, even CSRF protections by the banking site have no effect, because the script can simply do the same as the user would do

The CSRF token contains information only available to the browser and the friendly site.

Since the attacking site can't read the token, the attacking site can't construct a request that includes it. The friendly site can determine that the request constructed by the attacking site is untrustworthy because it doesn't include the token.

If the Same Origin Policy didn't exist, then the attacking site could read the token, which would render the token useless.

Since the Same Origin Policy does exist, that isn't a concern.

Answer 2

You are misunderstanding some things, the SOP says that if you open http://bad.com/bad.html and that page loads and executes bad.js , that javascript can make an AJAX request to bad.com , but any request pointing to good.com will be blocked unless good.com accepts it explicitly (by using CORS protocol).

The reason is that any request to any site may include the cookies that the browser has stored related to that site, so bad.com could use the session that you did not close on good.com to do something harmful.

So regarding your questions: No, a tab is not aware of other tabs unless they are related (parent - child), so a page cannot modify the behavior of another one. And the SOP ensures that a page cannot impersonate as another one