Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This blog is describing a way to hide the referer header in various situations. Specifically he is referring to things that run in the about:blank context.

  • What is the about:blank context?

  • How does about:blank, 307 redirect, and CORS relate to this? (or how would I determine this outside of the blog?)

  • Are there additional things that run in the about:blank context besides those listed?

  • Are there other security contexts that run in parallel to about:blank?

share|improve this question
    
First of all i don't think its possible to run JS in about:blank (or the local security context) unless you have an 0-day... That being said, about:blank probably isn't useful to anyone. –  Rook Mar 29 '13 at 16:22
    
@rook I'm soon going to experiment with an iFrame with src=about:blank. Test cases and other ideas are welcome –  makerofthings7 Mar 29 '13 at 16:41
    
Beware when you use about:blank in an https website. The about:blank is in a different zone and some browsers will throw an annoying warning about 'mixed content' –  Jeff Mar 29 '13 at 16:54
    
In the case of data URI's, IIRC each URI seems isolated from every other. I.e. data:text/html;,foo cannot contact data:text/html;,bar. This may then also apply to about:'s –  Henning Klevjer Apr 1 '13 at 12:08

1 Answer 1

The about:blank is just a blank address-less browser screen, that will inherit the same security parameters of its caller. That said, you cannot exploit about:blank to bridge the JavaScript cross-domain access restrictions if thats what you're asking.

Despite its location is not part of your domain, it belongs to it, and will not run stuff in a different security level.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.