Web Security: Same-Origin Policies

Course details

In network communications, knowing where something came from can often be as important as what it contains. Browsers can be particular about this, sometimes surprising developers when things can't be reached or connected. In this course, learn how same-origin policies play an important role in web security, so you can develop secure, interactive sites. Find out how to build Ajax requests using headers that affect the origin, how to work with server-only cookies, how to create secure communications between browser windows or tabs from the same origin, and more.

Learning objectives
Working with browser security features
Configuring servers for testing
Defining an origin
Cross-site scripting attacks
Cross-site request forgery attacks
Working with a received message
Specifying the allowed message sender origin
Sharing cookies across subdomains
Restricting the path of a cookie

Concepts

Introduction

Working with browser security features
What you should know
Set up your environment
Configure servers for testing

Basics of Same-Origin Policies

Understanding same-origin policies
Defining an origin
Cross-site scripting attacks
Cross-site request forgery attacks

Securing Shared Data with CORS Restrictions

Cross-origin resource sharing
Create a permissive Access-Control-Allow-Origin header
Create a tailored Access-Control-Allow-Origin header

Securing Sites with a Content Security Policy

The Content-Security-Policy header
Build a Content Security Policy header
Create a Content Security Policy meta element
Create a Content Security Policy for a widget
Create a highly restrictive Content Security Policy

Securing Communication with Transport Security

The Strict-Transport-Security header
Implement the Strict-Transport-Security header
Include subdomains in Strict-Transport-Security
Add a domain to the Strict-Transport-Security preload list

Communicating Securely across Browser Windows

Code that communicates across windows
Implement the postMessage method
Work with a received message
Specify the target domain for a message
Specify the allowed message sender origin
Use cross-window data in an app

Securing Cookies

How cookie origins are defined
Restrict a cookie to a subdomain
Share cookies across subdomains
Restrict the path of a cookie
Limit a cookie to the same site
Work with server-only cookies

Conclusion

Next steps