The Web Origin Concept

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 20
Abstract: This document defines the concept of an "origin", which is often used as the scope of authority or privilege by user agents. Typically, user agents isolate content retrieved from different origins to prevent malicious web site operators from interfering with the operation of benign web sites. In addition to outlining the principles that underlie the concept of origin, this document details how to determine the origin of a URI and how to serialize an origin into a string. It also defines an HTTP header field, named "Origin", that indicates which origins are associated with an HTTP request. [STANDARDS-TRACK]
Publication Date: 2011-12-01
Status Note: Proposed Standard
DOI: 10.17487/RFC6454
Link: https://doi.org/10.17487/RFC6454
Author(s): Adam Barth
Keyword(s): Same-origin, Security, Cross-origin

Latest version of IETF RFC 6454

Document Versions — IETF RFC 6454

▶ IETF RFC 6454 (2011-12-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 20 [Active*]
IETF RFC 2119 [Active*]
IETF RFC 2616 [Superseded*]
IETF RFC 3864 [Active*]
IETF RFC 3986 [Active, Amended*]
IETF RFC 4790 [Active*]
IETF RFC 5234 [Active, Amended*]
IETF RFC 5890 [Active*]
IETF RFC 5891 [Active*]
UNICODE.STD.6.0.0 — Unicode 6.0.0 EXTERNAL

Bibliographic Reference(s)

Jackson, C. and A. Barth, "Beware of Finer-Grained Origins", 2008, < http://w2spconf.com/2008/papers/s2p1.pdf >. EXTERNAL
Barth, A., Jackson, C., and J. Mitchell, "Robust Defenses for Cross-Site Request Forgery", 2008, < http://portal.acm.org/citation.cfm?id=1455770.1455782 >. EXTERNAL
Barth, A. and I. Hickson, "Media Type Sniffing" , Work in Progress, May 2011. EXTERNAL
Barth, A., Felt, A., Saxena, P., and A. Boodman, "Protecting Browsers from Extension Vulnerabilities", 2010, < http://www.isoc.org/isoc/conferences/ndss/10/pdf/ 04.pdf >. EXTERNAL
IETF RFC 2397 [Active*]
IETF RFC 2817 [Active*]
IETF RFC 3490 [Superseded*]
IETF RFC 5246 [Superseded*]
IETF RFC 6265 [Active*]
IETF RFC 6455 [Active*]
W3C.cors — CORS EXTERNAL
W3C.html5 — Latest version available at < http://www.w3.org/TR/html5/ >. EXTERNAL
W3C.WD-cors.20100727 — CORS EXTERNAL
W3C.WD-html5.20110525 — HTML EXTERNAL

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC6454.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 6454, The Web Origin Concept. Available at https://doi.org/10.17487/RFC6454

Snippet:

IETF RFC 6454, The Web Origin Concept. Available at https://doi.org/10.17487/RFC6454

HTML (ISO 690 compliant)

Preview:

IETF RFC 6454, The Web Origin Concept. Available at https://doi.org/10.17487/RFC6454

Snippet:

<span class="citation"><cite>IETF RFC 6454</cite>, The Web Origin Concept. Available at <a href="https://doi.org/10.17487/RFC6454" target="_blank" rel="noopener">https://doi.org/10.17487/RFC6454</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 6454, The Web Origin Concept
doi: 10.17487/RFC6454
url: https://doi.org/10.17487/RFC6454

Snippet:

<li>
<cite id="bib-rfc6454">IETF RFC 6454</cite>, The Web Origin Concept
<span class="doi">10.17487/RFC6454</span>
</li>

Referenced By

IETF RFC 6455 [Active*]
IETF RFC 6555 [Superseded*]
IETF RFC 6690 [Active*]
IETF RFC 6797 [Active*]
IETF RFC 6920 [Active*]
IETF RFC 7030 [Active*]
IETF RFC 7541 [Active*]
IETF RFC 7616 [Active*]
IETF RFC 7838 [Active*]
IETF RFC 8075 [Active*]
IETF RFC 8615 [Active*]