Same-Origin Policy

2 articles

Cybersecurity 19 Sep 2026 7 min read

DNS Rebinding Preserves Web Origin While the Network Destination Changes

DNS Rebinding Preserves Web Origin While the Network Destination Changes A browser can treat two requests as same-origin even when the TCP connections behind them terminate at different IP addresses. The origin model is built from the URL scheme, host, and port. DNS resolution is a network operation beneath that identity. If a hostname resolves to one address and later resolves to another, the browser-facing origin can remain unchanged. DNS rebinding exploits that separation. An attacker-controlled hostname can initially resolve to an attacker-controlled server that delivers script, then later resolve to an address reachable from the victim’s network. Subject to browser, resolver, transport, and target-service behavior, subsequent requests for the same hostname can then cross a network boundary without becoming cross-origin in the browser’s origin model.

Cybersecurity Browser Security

Cybersecurity 16 Sep 2026 10 min read

DNS Rebinding Turns Name Resolution Into a Moving Network Boundary

A browser loads script from an attacker-controlled hostname while that name resolves to a public server. Seconds later, another lookup for the same hostname returns a private address such as an RFC 1918 destination. The browser still sees the same scheme, host, and port in the URL, yet a subsequent connection can terminate at a different machine. That gap between web origin identity and network destination is the basis of DNS rebinding. The same-origin policy primarily reasons about origins expressed through URL components; it does not define an origin by the IP address selected by DNS for each connection. An attacker who controls both a hostname and its DNS answers can exploit that separation when a browser is permitted to resolve the name to a target reachable from the user’s network.

Cybersecurity DNS