07.04 · Lecture
Least Privilege and Blast Radius
Enumerate the deliberate exceptions to the same-origin policy - postMessage, CORS and the others - and say how each one widens what an attacker can reach.
Same-origin policy exceptions are intentional holes in browser isolation, and each one increases blast radius. CORS, postMessage, JSONP, cross-origin embeds, legacy domain relaxation and OAuth redirects all permit specific cross-origin flows. The security work is knowing exactly what crosses the boundary, who can trigger it, and what an attacker gains if it is wrong.
What this lesson answers
- how does CORS increase blast radius
- when is postMessage unsafe between origins
- which browser features bypass same origin policy
Notes
Least Privilege and Blast Radius — Least privilege exists to ensure code, users, and origins receive only the minimum access required, because without it one XSS, leaked token, or misconfigured cross-origin exception can expand from a single page into account takeover, data exfiltration, or service-wide compromise.
Key Concepts: - Same-Origin Policy defines an origin as , so `https://app.example.com:443` and `https://api.example.com:443` are different origins even though they share `example.com`.
References
Common questions
- Why is CORS a least privilege problem?
- CORS is an access grant from a server to browser code running on another origin. If the allowed origin is too broad, or credentialed requests are enabled carelessly, a hostile site can read responses that were meant only for a trusted frontend. Treat each CORS rule like an API permission.
- What makes postMessage dangerous?
- postMessage is safe only when both sides validate the other origin and the message shape. Sending to a wildcard target or accepting messages from any origin turns a narrow communication channel into an ambient command interface. A malicious frame or popup can then trigger handlers that were written for trusted pages.
- Are cross-origin forms and images harmless if responses cannot be read?
- No. Same-origin policy often blocks reading the response body, but it does not always stop the request from being sent. That matters when cookies or other browser credentials are attached automatically. A hidden form or embedded resource can still cause state-changing actions unless CSRF protection and request validation are in place.
Short definition: what is Least Privilege and Blast Radius?