Cross-Origin Security

Summary: Security considerations and policies that govern how web content from different origins (protocol, domain, port combinations) can interact with each other. Critical for protecting user data and preventing malicious cross-site attacks while enabling legitimate cross-domain functionality.

Overview

Cross-origin security is a fundamental web security model that restricts how documents or scripts from one origin can access resources from another origin. An origin is defined by the combination of protocol (HTTP/HTTPS), domain, and port. The Same-Origin Policy serves as the cornerstone of this security model, blocking most cross-origin requests by default to prevent malicious sites from accessing sensitive data.

The security model addresses several critical threats including cross-site scripting (XSS), cross-site request forgery (CSRF), and data exfiltration attacks. Modern web applications often require legitimate cross-origin communication, leading to the development of controlled mechanisms like CORS (Cross-Origin Resource Sharing) that allow servers to explicitly permit specific cross-origin requests.

Key security boundaries include:

  • Document access: Scripts cannot read content from cross-origin documents
  • Network requests: XMLHttpRequest and Fetch API are restricted by default
  • Cookie access: Cookies are isolated by origin
  • Local storage: Browser storage is partitioned by origin
  • Frame interactions: Cross-origin iframe communication is limited

Key Details

Origin Definition: An origin consists of scheme (protocol), host (domain), and port. https://example.com:443 and http://example.com:80 are different origins.

Same-Origin Policy Restrictions:

  • Cross-origin DOM access is blocked
  • XMLHttpRequest/Fetch to different origins requires CORS headers
  • Cookies are not sent with cross-origin requests unless explicitly configured
  • Local/session storage is isolated per origin

CORS Headers:

  • Access-Control-Allow-Origin: Specifies allowed origins
  • Access-Control-Allow-Methods: Permitted HTTP methods
  • Access-Control-Allow-Headers: Allowed request headers
  • Access-Control-Allow-Credentials: Enables cookie sharing

Security Bypass Techniques:

  • Preflight requests: Browser automatically sends OPTIONS request for complex cross-origin requests
  • Simple requests: GET, POST, HEAD with basic headers can bypass preflight
  • Credentials handling: withCredentials flag controls cookie transmission

Content Security Policy (CSP): Additional layer that can restrict resource loading origins through directives like script-src and img-src.

Cross-Origin Embedder Policy (COEP) and Cross-Origin Opener Policy (COOP): Modern headers that provide additional isolation controls for embedded content and popup windows.

Relationships

  • Web Agents — Must navigate cross-origin security when automating interactions across different domains
  • Browser Automation — Tools like Selenium must handle cross-origin restrictions when testing web applications
  • DOM Snapshots — Cross-origin security affects which DOM elements can be accessed when capturing page state
  • Element Extraction Techniques — May be limited by same-origin policy when scraping cross-domain content
  • Web Scraping — Must account for CORS policies and origin-based access controls
  • LLM-Based Interaction — AI agents need to understand origin boundaries when interpreting web content
  • Cookie Management — Cross-origin cookie policies directly impact session handling and authentication
  • CSRF Protection — Cross-origin security mechanisms help prevent cross-site request forgery attacks

Sources