1

There are four general cross-site request combinations security-wise, and I want to know whether ysite.com, in each case, knows that the reason I downloaded one of its resources was because I was visiting the specific URL that referenced it (xsite.com/page.html), or if not the specific URL, the site / domain perhaps:

  1. I visit https://xsite.com/page.html. It references https://ysite.com/library.js.
  2. I visit https://xsite.com/page.html. It references http://ysite.com/image.jpg.
  3. I visit http://xsite.com/page.html. It references https://ysite.com/library.js.
  4. I visit http://xsite.com/page.html. It references http://ysite.com/image.jpg.

And in the cases above where ysite.com cannot know what site / URL I was browsing in order to download its resource - will it look no different than if I directly downloaded the image or js file from the browser address bar itself, when it comes to their site's server logs? Will it look different in other ways compared to embedment on another website, due to TCP timing difference subtleties, HTTP header information (or lack of it) in the HTTP request (or lack of even certain HTTP headers in the GET request at all?), or any other differences in transport or application layer interaction that they could see at their server?

Of interest, is whether sites can prevent direct url image hotlinking from external HTTPS domains. If they can, then I assume HTTPS site URLs CAN be leaked to third-party objects' webservers, unless their method for blocking HTTPS hotlinking is a way that ALSO prevents direct access to the image WITHOUT being referred by a URL from the image's webserver.

Improve this question
1
  • You usually check the Refer HTTP header to get these kind of information.
    – Steffen Ullrich
    Jan 10, 2015 at 16:01

2 Answers 2

Reset to default
1

It is most browser dependant, but as per RFC, case 2 should not have the Referer header per security reasons. In all other cases, RFC states that it could be included unless the user has configured any privacy setting (like private browsing).

So in cases 1, 3 and 4, ysite would probably get the whole referer xsite.com/page.html and in case 2, it (probably) will not get any information.

For that reason, most CDN, advertisement and/or analytics sites have javascript that allows them to rewrite their links to match the same protocol (http/https) as the refering page.

Improve this answer
0

I believe the answer to your question is, cross-site scripting controls are enforced at the browser level, not at the site level, so it doesn't matter where ysite thinks the download came from - it matters that the browser that loaded xsite knows that the load to ysite came from a different domain.

Improve this answer

You must log in to answer this question.