Tests vectors that cause requests or messages to appear to originate from a different origin than the actual sender.
A sandboxed iframe (without allow-same-origin) has origin null. If a server accepts Origin: null, requests from a sandboxed iframe bypass origin checks. Some CORS configs respond to null with Access-Control-Allow-Origin: *.
Demonstrates a page that receives postMessage without validating event.origin. Any window (cross-origin) can send commands to it.
If two pages on subdomains both set document.domain to the parent domain, they can access each other's DOM despite different subdomains. Demonstrates the attack setup.
Sends a cross-origin fetch from a sandboxed context (null origin). If the target server's CORS policy reflects null origin or allows *, the request succeeds. This tests for the common CORS misconfiguration.
Attempts to set a custom Origin header on a fetch request. Browsers classify Origin as a forbidden header and block manual overrides. This test confirms the browser enforces the restriction.
An iframe with srcdoc attribute inherits the parent's origin (unlike a sandboxed or cross-origin iframe). Demonstrates that attacker-controlled HTML in srcdoc runs with the parent's origin.