Same-origin policy: The core of web security @ OWASP Wellington

This session we've got Kirk Jackson from RedShield presenting, and he's going to introduce the same-origin policy that underpins browser security.
Abstract:
The "same-origin policy" is a loosely defined set of rules that has evolved over the years since javascript was first introduced in 1995.
In this talk, Kirk will explain how origins work in your web browser, and why they are the fundamental protection against attacks like cross-site request forgery.
Along the way we'll look at how you can leverage the same-origin policy to protect data on your site, and how you can bend it to your will to allow functionality to be hosted on multiple urls -- such as cross-origin resource sharing (CORS), PostMessage and JSONP.
Speaker Bio:
Kirk is an application security analyst and researcher at RedShield, where he protects vulnerable web apps for a living. Kirk organises the Wellington OWASP meetup, helps organise the OWASP NZ Day conference, and has presented at various conferences, meetups and code camps in New Zealand and overseas - usually on the topics of developer security and web security.
Live-stream:
This video will kick off at about 6pm on Monday 2 October and live-stream the session. After the session concludes you'll be able to watch at your leisure.

[@roboedar]

It's like I can physically feel my brain growing from this knowledge. Thank you.

[@mohideenabdulkatheerm37]

0:01 Introduction 2:10 What is an origin? 3:13 What is the same origin? 4:18 Same-origin policy 19:53 Why is same-origin policy important? 20:57 How does it apply to ___ ? 21:54 How does SOP apply to anchors? 22:28 How does SOP appy to forms? 24:54 How does SOP apply to images? 25:51 How does SOP apply to CSS? 27:32 How does SOP apply to JavaScript includes? 28:58 How does SOP apply to JSONP? 31:55 How does SOP apply to web storage? 34:40 How does SOP apply to cookies? 38:31 How does SOP apply to windows, frames and s? 40:36 How does SOP apply to XMLHttpRequest? 43:49 How does SOP apply to Java, Flash, PDF, Silverlight? 45:10 Getting around same-origin policy 45:53 Using PostMessage to communicate between frames 52:48 Using Cross-Origin Resource Sharing (CORS) 57:48 How to? 58:52 How to: Get data from another site? 58:47 How to: Isolate user content? 1:00:19 How to: Share cookies? 1:01:31 Limitations 1:03:04 Conclusion

[@ys5399]

Thank you! This is one of the best tutorial/talk on SOP I have ever seen!

[@user-ze4qq8mm1q]

this is the best video on SOP and CORS on the whole internet. Thank you a million.

[@vikas3916]

Best Video I watched By Far

[@stolensentience]

This was fantastic. Really long video but was so easy to watch and explained what I couldn’t grasp from 10 other 10-20 minute videos and countless documents of thousands of words. Thank you so much! Obviously solid and even casual grasp of this complex stuff

[@cookkieoverflow2952]

The best explanation on SOP.

[@manis1845]

Best video on SOP. Thank you. Please keep posting these type of videos

[@arindamgupta3174]

This is excellent material! I finally understand this complicated concept. Thanks!

[@sto2779]

Excellent explanation into the subjects, answers all my questions.

[@venkaraj]

Such an insightful video .Watched it couple of times to get a grasp of each minute

[@ravivashatkar5585]

Certainly one of the best videos. Good one !

[@keliliu4849]

Thank, it was so clear! Helped me a lot with class I'm taking.

[@CodaJohnPaul]

Fantastic, subscribed immediately. Thank you for this!

[@bafellah9727]

Thank you , Best vedio ever seen in SOP

[@nikosc]

Super useful and well presented. Fundamentals of web app security.

[@Galileo51Galilei]

Thank you very much for this wonderful talk. Very interesting, those rules and concepts are not taught enough in web development training courses wheareas it is fundamental

[@tingping7684]

Thanks you, i love it

[@soulstream666]

This is golden ❤ Perfect talk.

[@VamsiKrishna-yt5hi]

why didn't YT show this to me earlier..??!! Amazing work.

[@somebody3014]

thank you

[@sureshkhatri7321]

Thank you so much !

[@cliffmathew]

Excellent! Very clear. Thank you very much.

[@deusman4150]

Very nicely done!

[@saideepakaleti4160]

Great content explained wonderfully thank you

[@FahadAlQallaf]

Thanks Kirk ! great video.

[@thapr0digy]

Loved this video. Very informative!

[@ahmedkhalifa8273]

thank you , more than enough

[@Itxpc]

Awesome!!

[@the-baker]

a Great explanation, thanks a lot

[@felipechagas7618]

Amazing content!

[@alexsh.8080]

Best explanation

[@jub0bs]

Great tutorial.

[@crusader_]

Nicest content

[@georgetsiklauri]

So, you mention HTTP POST loading a new/different context.. but wouldn't that be true for the GET as well? GET actually gets the fresh new document each time it's invoked.. and that new document is rendered into browser. I'm almost certain it should also load into a new/different context. Am I wrong?

[@ex0day]

awesome

[@georgetsiklauri]

It's really unclear how you're opening a new window at 11:22. You don't execute any JavaScript, but new tab/window somehow opens. Are you repeating last executed command? it's not visible.

[@weihaoguo3964]

Hi, this course is amazing ! Would you share the demo source code of html and javascript?

[@domaincontroller]

02:10 origin, url, scheme

[@chethanb6406]

can we have a link to that presentation please?

[@domaincontroller]

04:17 history

[@jub0bs]

What's that CSRF talk that is mentioned at 35:00? This one: kzbin.info/www/bejne/fWLEfXqXgtaho5I ?

[@Krainiiserver]

thank you