origin-threats.md

SOP Threat Model

• evil.com:<script> ----🍪----> facebook.com/🤐.csv
  • fix: opaque response
• evil.com:<script> ----🔟----> go/🤐.csv
  • fix: opaque response

CORS Threat Model

• evil.com:XHR:X-Data --🍪--> facebook.com/🤐.json
  • fix: drop response (unless CORS headers opt in)
• evil.com:XHR:X-Patriot --🍪-> us.mil/🚀
  • fix: preflight
• evil.com:@font-face ---------> cdn.com/💰.woff
  • fix: drop response (unless CORS headers opt in)

App Threat Model

• evil.com:<a> -------🍪------> bank.com/🚀
  • fix: no side effects through GET
• evil.com:<form> -----🍪-----> bank.com/🚀
  • fix: session token

Legend

• 🍪 - cookie (authentication)
• 🔟 - intranet IP address
• 🤐 - secret data
• 🚀 - side effect
• 💰 - copyrighted asset