Timeline for Child iFrame hash verification of parent iFrame content
Current License: CC BY-SA 3.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 16, 2013 at 4:20 | history | bounty ended | CommunityBot | ||
| S Sep 13, 2013 at 8:40 | history | suggested | Indolering | CC BY-SA 3.0 |
Rewrote to answer question more directly
|
| Sep 13, 2013 at 3:11 | review | Suggested edits | |||
| S Sep 13, 2013 at 8:40 | |||||
| Sep 10, 2013 at 23:12 | vote | accept | Indolering | ||
| Sep 10, 2013 at 22:13 | comment | added | Indolering | let us continue this discussion in chat | |
| Sep 10, 2013 at 21:03 | comment | added | Philipp Gayret | Alright, ive updated my answer, lastly, "For seamless domain-name masking, Victor must place CORS authorization in the headers from his site to dance around the single origin policy" Why do we need to use CORS? Wouldn't it be a lot simpler if you'd use the fragment identifier, and changing the iframe location when it changes, and vice-versa? | |
| Sep 10, 2013 at 21:00 | history | edited | Philipp Gayret | CC BY-SA 3.0 |
added 388 characters in body
|
| Sep 10, 2013 at 20:50 | comment | added | Philipp Gayret | You need a proxy when you cannot CORS directly from iframe victor.alt to victor.eve.tld, that's what i posted in the answer. ( The proxy is more or less our read access to the top window, because we cannot read the iframe nor can we request victor.eve.tld/ which would be the other option ) | |
| Sep 10, 2013 at 16:16 | comment | added | Indolering | I just didn't understand why you were verifying the site contents using a proxy. As far as the read/write access, if a user made it to the correct IP, then Victor really doesn't care what DNS information Alice has. Thus he only needs to verify the URL rewriting JS and we can prevent Victor from tampering with the DNS information. | |
| Sep 10, 2013 at 14:13 | comment | added | Philipp Gayret | When you said "Victor does not need to check Eve's site at run time", he has to to verify it has no malicious JS injected. Also what do you mean exactly with "What if the read/write access was set by script that was sandboxed from all parties?" You really cant have read access to a parent or child frame, you can pretty much only use postMessage to communicate ( or change the URL #hashthing ) | |
| Sep 10, 2013 at 5:44 | comment | added | Indolering | Okay, it seems as if CORS does not allow for read-only access. Indeed, none of the browser security mechanisms include read-only mechanisms. The only parts that need to persist across sessions is domain<->IP mappings in localStorage. What if the read/write access was set by script that was sandboxed from all parties? The parent frame only needs to rewrite .alt -> eve.tld and manage the URL states. | |
| Sep 10, 2013 at 4:51 | comment | added | Indolering | I've updated the question to clarify that Victor does not need to check Eve's site at run time, he can simply include them in his JS. | |
| Sep 9, 2013 at 11:53 | history | edited | Philipp Gayret | CC BY-SA 3.0 |
added 228 characters in body
|
| Sep 9, 2013 at 11:45 | history | edited | Philipp Gayret | CC BY-SA 3.0 |
added 74 characters in body
|
| Sep 9, 2013 at 11:37 | history | answered | Philipp Gayret | CC BY-SA 3.0 |