November 2011
Intermediate to advanced
320 pages
10h 18m
English
Designs that extend the bounds of the same-origin policy are fairly simple to understand and typically fail securely. If the proposed change is not accounted for in one of the possible code paths, or is simply not supported in a particular browser, the previously implemented, more restrictive logic will kick in. Compared with this, it is far more dangerous to try to erect new boundaries on top of the existing browser security model. That’s because every security-sensitive code path must be tweaked to recognize the new scheme and every browser must comply right away, or unexpected problems will arise.
In this section, we will take a quick look at some of the more accomplished attempts to take this dangerous ...
Read now
Unlock full access