The use of client-side scripting languages like JavaScript has been crucial in the development of the semantic web. However, in terms of security, it has also given the opportunity to computer criminals to conduct a wide range of cross-site scripting attacks. Historically, the Same Origin Policy has been one of the many mechanisms introduced to counteract this problem. With this policy in place, scripts are allowed to run on webpages only when they originate from the same source or site. This means that for documents or webpages to be retrievable, they have to belong to the same origin: same scheme or application layer protocol, same host or server and same port of a URL. Despite of its good intention, the SOP is seen as a nuisance by web developers. The claim is that the SOP is too restrictive and inflexible affecting the introduction of creative and innovate applications. In order to alleviate this problem, the World Wide Web Consortium (W3C) introduced the Cross-Origin Resource Sharing (CORS) as a mechanism to relax the SOP policy.
Based on this background information and your personal research, please address the following issues associated with the SOP and CORS policies.Using the CQU domain (www.cqu.edu.au) explain and provide your own illustrative example of how the SOP policy works Assume that in the CQU server you have an html page (your_homePage.html) identified by the URL: www.cqu.edu.au/your_homePage.html
Provide two examples of URLs (web links) found in your_homePage.html for which the retrieval of the documents is allowed. Similarly, provide two examples of URLs (web links) in your_homePage.html for which the retrieval of the documents is denied. Use the following table to provide the URLs and give the reasons for the outcome of the retrieval of the pages.Your examples (URLs) Retrieval Allow/Deny Explain the reason Allow Allow Deny Deny
In your own words explain the concept behind the CORS policy Using the two examples given above where the retrieval of the pages was denied, explain the interaction on how the access would be enabled using CORS. Make sure that in describing the interaction the Origin and the Access-Control-Allow-Origin are used in the HTTP headers.