1

Here is something I have been wondering about for the longest time. It seems very simple, but to this day I do not know any practically usable technology.

Is there a way that I can browse the internet and enforce a universal "same origin" policy?

By that I mean that my browser will simply not issue any network requests for anything that isn't in the same domain as the root website that I am visiting. Nothing. No images, no CSS, no JavaScript, no frames, no iframes, no AJAX requests, no plugin video content.

Even though the WWW is now well into its adult life, it still seems like there is no way for me, the user, to visit a website which contains an image sourced from a third party server without that server knowing that I visited the website. I know that there are several individual, ad-hoc workarounds, but the very simple heart of the matter is that I should be able to instruct my browser in simple, broad terms to never start any requests to any off-site location.

(Please don't tell me that this will break lots of sites. That's not a problem. This is a question of principle.)

Does any such technology exist? Any special browsers, or plugins for popular browsers?

Improve this question
3
  • 2
    Please don't tell me that this will break lots of sites. That's not a problem. but it is. It will break most sites nowadays, including Stack Overflow and the entire SE network. If you're worried about privacy, there are other, better avenues to investigate
    – Pekka
    Commented Aug 15, 2011 at 17:01
  • Why not? It's my browsing experience, I'm asking for a technology that lets me access those parts of the internet which I want, not those which other parties tell me I should want. Practically, there are loads of websites that would be much less painful to read with universal same-origin in place... and practically there'd be a per-site override, of course. I'm interested in the principle. It sounds like such a basic idea...
    – Kerrek SB
    Commented Aug 15, 2011 at 17:04
  • I think a plug-in must exist - the best chances are probably with Firefox because it has the most plugins. But it's admittedly tough to find the right search keywords for.
    – Pekka
    Commented Aug 15, 2011 at 17:07

2 Answers 2

Reset to default
3

This is a good question but I would have to agree with Pekka. Perhaps you may not realize the consequences of doing so. For example say you visit one of the many many sites that use jQuery from the Google CDN. If this site just happens to not be coded in manner that makes it gracefully degrade (ie. bad coding standards) then you may be stuck on the home page because the coder decided to use jQuery logic exclusively for his navigation. This is a very common thing. Doing so is similar to wanting to disable all scripts and then expect for the internet to work properly; some pages might, and others may be completely unusable/unbrowsable.

Improve this answer
4
  • I'm happy with that risk. Seriously. All I want is the freedom to choose which data I want, and not have other people determine what my computer downloads.
    – Kerrek SB
    Commented Aug 15, 2011 at 21:36
  • I would suggest using Backtrack's version of Firefox then. I'm not positive that it would block all non-local requests, but from personal experience I have never seen a browser as locked down as that one. Check it out here.
    – k4t434sis
    Commented Aug 15, 2011 at 21:49
  • +1 @Kerrek SB I can't think of a site I've built recently that wouldn't be destroyed by this, and that's ignoring anything for obvious "tracking" purposes like analytics and such. People run their content through CDNs, blogs use Flickr for hosting their images, etc. This is interesting, but verges on being a conceptual discussion, and I'd argue you're getting resistance because the SE sites aren't really intended for that sort of thing(and it's largely off-topic here to start). You'd probably fare better on a security list/forum.
    – Su'
    Commented Aug 16, 2011 at 0:16
  • 1
    ... or security.stackexchange.com ... (if the question remains "does this exist?")
    – danlefree
    Commented Aug 16, 2011 at 10:45
0

I don't know if such a plugin exists, but NoScript for the mozilla browser can do a big part of what you want. It not only allows blocking scripts, it also can prevent loading of other external objects, and you can activate/deactivate individual domains, from a list of domains your page is linking to.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.