Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Someone can please explain to me how does the "Same Origin Policy" feature protect us from web attacks (XSS,CSRF, etc)?

share|improve this question
up vote 2 down vote accepted

This depends on the context.

If you have a "Same Origin" policy on executing scripts within a website then only scripts which come from the same domain name (website) as the website itself can be run. This stops hackers from injecting scripts into a website through such things as dodgy adverts and such.

If you have a "Same Origin" on such things as AJAX calls, then the server will only honor requests for AJAX calls that come from the domain of the website that the AJAX server is associated. This prevents other sites from erroneously calling your AJAX routines.

So it's basically to try and ensure that requests and scripts come from the correct locations and aren't being replaced or introduced by hackers.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.