Chapter 9. Content Isolation Logic
Most of the security assurances provided by web browsers are meant to isolate documents based on their origin. The premise is simple: Two pages from different sources should not be allowed to interfere with each other. Actual practice can be more complicated, however, as no universal agreement exists about where a single document begins and ends or what constitutes a single origin. The result is a sometimes unpredictable patchwork of contradictory policies that don’t quite work well together but that can’t be tweaked without profoundly affecting all current legitimate uses of the Web.
These problems aside, there is also little clarity about what actions should be subject to security checks in the first place. ...
Get The Tangled Web now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
