https://nalar.dev/tags/origin/ Recent content in Origin on Nalar Hugo en-us Wed, 16 Sep 2026 00:00:00 +0700 https://nalar.dev/websocket-origin-checks-keep-browser-sessions-inside-an-explicit-trust-boundary/ Wed, 16 Sep 2026 00:00:00 +0700 https://nalar.dev/websocket-origin-checks-keep-browser-sessions-inside-an-explicit-trust-boundary/ <p>A user can be signed in to a WebSocket-backed application while browsing an unrelated site in another tab. JavaScript on that unrelated site can attempt a WebSocket connection to the application&rsquo;s endpoint. If the browser attaches credentials applicable to the handshake and the server upgrades the connection without checking the initiating origin, the new message channel can inherit authenticated authority that the page itself was never meant to receive.</p> <p>This boundary differs from ordinary cross-origin <code>fetch()</code> handling. WebSocket establishes its own protocol channel through an HTTP opening handshake, and the server has to decide whether the browser origin named in that handshake is permitted to create the channel. CORS response policy is not a substitute for that decision.</p>