What kind of attack are prevented by running code submitted by the user in a Javascript Web Worker? Do they prevent attacks like XSS, or is it better to use some other sandboxing method to protect against most vulnerabilities?
2
-
1I had a quick look at WebWorker and it doesn't look like a security feature? AFAIK, it's a way to implement background tasks. Possibly related: stackoverflow.com/questions/16600607/…– tangrsCommented Jul 22, 2015 at 3:41
-
XSS is probably the least of your security concerns if you're running user-written Javascript.– Neil SmithlineCommented Jul 22, 2015 at 4:05
Add a comment
|
1 Answer
It looks like WebWorkers are not a security feature, but simply a way to run background threads on the client side of the web application. This means they don't protect you from any existing attacks but they may instead introduce new attack vectors :(
Of interest in this regard might be the communication between the workers and the main thread: they are reusing the postMessage interface which was originally used to communicate between different frames. By using the same interface it also adds the same security issues. This means you should check for the origin of a received message in your message event handler. The example code you will find for web workers usually does not do this.
answered Jul 22, 2015 at 6:20
-
Thanks for the answer! I do know that web workers aren't designed to be a security feature, but I looked at several posts here and many people recommended using them for sandboxing. I guess that's what I get for listening to what people on the Internet say, eh? Commented Jul 22, 2015 at 11:57
-
@CivvyThePandaTM: they are not wrong and you can do some limited sandboxing using WebWorkers since they don't have access to the document. But since this is more a side effect of how they work was not explicitly introduced as a security feature I would not trust it fully. Commented Jul 22, 2015 at 13:21
-
If you are able to get XSS in an application and can add a web worker, you have essentially created a method of persistence, so they can be quite nasty. The main issue relates to 'bypassing' same-origin-policy with CSRF HXRs. Luckily, workers are part of the Content-Security-Policy spec, so you can limit your exposure with
worker-src 'self'for example. And XHR requests made from workers would also be restricted by CSP.– hiburn8Commented Feb 10, 2020 at 10:27