🛡️

XSS, CSRF & Browser Security Model

Medium

Free preview · 2 of 5 steps

The browser security model

Browsers enforce a Same-Origin Policy (SOP): JavaScript from one origin (scheme + hostname + port) cannot read data from another origin. This is what prevents evil.com's JavaScript from reading your bank session.

However, SOP has two critical weaknesses: XSS bypasses it by injecting script into the trusted origin itself, and CSRF exploits the fact that browsers send cookies with cross-origin requests even though SOP blocks reading the response.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step