All right, now let's talk about this same origin policy, same margin policy is a security mechanism,
so let's see what this does.
And according to this same policy, a browser executed script only if request as same protocol, same
domain name and simple number.
So this is very important.
This, uh, same protocol, same the and.
So let's see an example to get a better understanding.
Suppose we are a cynical dotcom see slash user one.
So I have logged in as user one and you are a YouTube's user one.
Then see the protocol duties and the domain name is Nicholas and the sport is 80 by default and we cannot
execute a script into our domain.
Suppose if I wrote a JavaScript into this little dot com.
And if I say studious, no rock'em secret, but the reason I suppose that's their secret to and if I,
uh, put this post request is in the new form, using the JavaScript in particular, come and ask for
it and order some secret text.
Then the script will not be executed by the browser because the protocol is has utopia's, but domain
name is different than Oracle and Nicarico.
So that difference in the domain will be identified by the browser.
And that script regarding the request, order for this, uh, will be discarded.
And you can see here it should be restricted at the moment.
But the number is one, two, three, four thirty.
That means there is another service on the one, two, three, four.
And whenever I just use the script, uh, in the regular complex, just this secret text.
Well, it is not because the phone number is different.
So the same margin policy difference that you can only run the scripts or access to documents.
The contents are only the same, the same protocol, the same domain name and the same number.
So there is another, uh, file in an Larcombe slash save file too.
Then you can simply access the file because, uh, it's in the same protocol saying over and no, but
you cannot access the other number or other domain names.
So that is about the same policy.
If the security mechanism is not set, uh, then it raises very serious security problems.
Uh, this is a sort of, uh, another attack.
So we see that in the system.
So basically, the attacker will craft, uh.
Link, so whenever you click on that link, a request like that request, our post request will be sent
to the server on behalf of your, uh.
On behalf of your session, that means some secret, but now I craft a script in this microcosm and
when our user clicks on this, then a post request or request will be sent to the secret activity,
but is not shown to the attacker.
But the script executes.
So this is very important.
So imagine, I hope, have understood the good script only if the request has some protocol on the same
domain on this important.