Software / Browser

The security model

The origin is the boundary. Policy says which exceptions are real.

![browser_security]
SOP CORS CSP SameSite SRI

Browser Security Model

Browser Security Model — concentric layers Security layers from innermost to outermost: Execution context at center. Same-Origin Policy (origin = scheme + host + port). CORS headers for cross-origin resource access. Content-Security-Policy allowlisting resource origins. HTTPS/TLS at the outermost transport layer. HTTPS / TLS Content-Security-Policy CORS headers Same-Origin Policy execution context origin = scheme + host + port · SameSite controls cookie dispatch · SRI validates subresource integrity
=[origin]

Same-Origin Policy

Origin = scheme + host + port. Scripts from origin A cannot read responses or DOM of origin B. Applies to fetch, XHR, window.opener, iframe content access, Web Storage, and cookies. The invariant all other mechanisms build on.

  • origin
  • site
  • schemelessly same-site
  • opaque origin
Same-origin policy WHATWG Origin
@[cors]

CORS

Credentialed or non-simple requests trigger a preflight (OPTIONS). Key headers: Access-Control-Allow-Origin, ACAO-Credentials. Credentials require non-wildcard ACAO. COEP/COOP/CORP enable SharedArrayBuffer and cross-origin isolation.

  • preflight
  • ACAO
  • credentials
  • COEP
  • COOP
  • CORP
CORS Fetch § CORS
![csp]

Content Security Policy

Allowlist for script, style, connect, img, media, and other resource sources. script-src 'nonce-{x}' is best practice for inline scripts. strict-dynamic propagates trust to dynamically-created scripts. Report-only mode enables incremental rollout via Reporting API.

  • nonce
  • strict-dynamic
  • report-to
  • Trusted Types
CSP CSP Level 3
$[cookies]

Cookies + SameSite

SameSite=Strict: no cross-site dispatch. Lax: top-level navigations only (default since Chrome 80). None requires Secure. HttpOnly prevents JS access. The __Host- prefix requires Secure, no Domain attribute, and path=/. CHIPS partitions third-party cookies by top-level site.

  • SameSite
  • HttpOnly
  • __Host-
  • CHIPS
  • partitioned
HTTP Cookies RFC 6265bis