How does the Same Origin Policy protect users?

Question

When I first learned about CORS and Same Origin Policy, I thought it was an honor system (enforced by browsers) to protect a website's resources from being stolen, bootstrapped, by other websites.

But since then I've read things here and there that suggest it's to protect users, and I'm not quite sure how it does that - How does SOP protect the end user?

Under the Same Origin Policy, a web browser permits scripts contained in a first web page to access data in a second web page, but only if both web pages have the same origin. This policy prevents a malicious script on one page from obtaining access to sensitive data on another web page through that page's Document Object Model. "Sensitive data" means things like credit card numbers, social security numbers and login credentials, not necessarily web assets. — Robert Harvey, Sep 08 '15 at 19:14
@RobertHarvey Where is the "second page"? You mean for example one fake site "payypal.com" opening a fullscreen iFrame to the real "paypal.com" and grabbing sensitive data from user input? Its the only situation I can think of, but I think a different policy covers not allowing iFrames to open pages with certain meta tags, not same origin, and even then, I think the inner page of an iFrame would have to cooperate with the outer page's script to communicate data. Not a good example :/ Can you give a good real-life example of a problematic possibility without SOP? — J.Todd, Sep 08 '15 at 19:42
Basically, if you inject a script into someone's Bank of America login page from SomeMaliciousSite.com to get their login information, it's not supposed to execute, because it didn't come from Bank of America's website. — Robert Harvey, Sep 08 '15 at 19:52
@RobertHarvey If you you would elaborate that as an answer, I'll accept! — J.Todd, Sep 30 '15 at 08:49

How does the Same Origin Policy protect users?

0 Answers0