I'm trying to create an extensible platform, where my site will provide a model and some views (both client-side, in the browser) and third party sites may add their own views as well. The goal here is that only my model will make HTTP requests to my server, and the third party views shall only make API calls to my platform, nothing more (they may also "call home" if they want to, but they must not touch anything not explicitly exposed to them through the API).
The proposed solution is creating an
invisible iframe for each third party extension, using only postMessage to communicate with them (Edit: to be a proper "view" it must be visible, of course, but as an alternative it can merely have the role of "controller", delegating the render of visual components to the main page - could be used if it added any security benefits, but ideally no). Would this properly "sandbox" the code? I'm assuming that:
- They might make GET requests on my server (including loading scripts from it), but as long as I use CSRF tokens where it matters I should be fine. This situation is no different from having two open tabs in the same browser, one of them authenticated with its respective site;
- They won't be able to clickjack the user,
sinceif their iframes are invisible; I'm also assuming they can't make them visible or resize them, since this would involve accessing the DOM of the parent page, is this correct?
- They can spam
console.logor access other "global" stuff. This is the worse problem I identified so far, and still unable to think of ways to prevent that.
- Clarifying: the issue here is the possibility of trying to impersonate the parent site, displaying a message asking for the password, for instance.
- They can embed flash or other plugins which may have security vulnerabilities. The fact it's in an iframe, however, does not make it worse in any regard, or am I mistaken?
Are these assumptions correct, is there anything else I should be aware of? Some level of trust will be necessary from the part of users (the idea is that each user should be able to choose extensions at his own leisure, regardless of my site endorsing them or not, while ultimately bearing the consequences of his choices), but I'd like to do everything possible to mitigate those risks.
Update: I'd like to clarify the question a bit, based on the questions raised by commenters. There are many reasons to include third-party scripts in a page - advertisement, analytics, interaction with social networks, etc. This is a security concern though, in fact it's one of the reasons people use AdBlock or NoScript (so you can seletively choose which domains are allowed to run code in your browser). Usually the site trusts the third parties whose scripts it includes, but not always (Facebook applications, for instance, can be made by anyone - but they run inside a Facebook page), and I have seen iframes been used to "isolate" third-party contents.
Though one option for cross-site communication in the browser is having two open tabs (or windows) using postMessage to exchange messages, a single page provides a more seamless experience. The full implications of using iframes (visible or invisible), and its viability in sandboxing untrusted contents, is my main concern in this question, and IMHO is applicable for a wider audience too (see paragraph above).
In my particular case, I'm trying to avoid having the embedded contents impersonate the parent site (see clarification in the 4th bullet point above) and to protect users in general from other nuisances as far as I can. While each user will have the capability to choose his own extensions, being ultimately responsible for the consequences, I'd like to mitigate any known problems that are within my reach (and try to educate users for those that aren't).