Disabling post-pageload http requests to account for XSS

Question

I have a website where JavaScript is used to process sensitive data (chat messages) on the client side. No communication is done with the server or any other service after the initial page load. It's possible that a conversation partner of the user could have malicious intentions, and try XSSing the conversation. To counter this, I want to be 100% sure that it's impossible for the application to send any messages after the initial page load, since it's acceptable if any XSS breaks the JavaScript application, but it's not acceptable for any messages to be sent.

Is there a way to be certain that my JavaScript application will not send messages anywhere after page load, when there is possibility of XSS attacks?

Answer 1

No. Your Javascript application can be modified by the end user on their own machine, and send anything anywhere.

You should look at ensuring that your server side component only accepts chat messages from authorised sources, and that it isn't possible to make the Javascript application an authorised client without information which isn't available to the end user (e.g. require a server generated token to send chat messages - look at CSRF protection methods for an example).

Anything running on a system you don't control can be modified given sufficient time and effort, so you need to keep your protection mechanisms on systems you control.