I am part way through creating a 3rd party service for an online game. Currently to pull the game data from outside the game I use my own auth cookies, however, I want to make this available for other players to use to see their personal stats and what not.

I can send the cookies from the game via a userscript or plugin. However, I want to ensure I'm handling their information securely. The cookies are stored in an AES encrypted table.

When sending from a userscript to a webserver via a XMLHTTP request, how can you ensure the security of the data during transit? Does SSL work when sending cross-domain?

1 Answer 1


If I understand correctly, you want to to have service A hand a cookie to the user's browser which is then submitted to service B, and you want that cookie to be secure throughout.

As far as network transit goes, if both service A and service B are enforcing SSL, then yes, it will be encrypted "in transit". But you (service A) may not have any control over whether service B uses SSL or not.

In any case, the actual browser in the middle will have access to that data, after it is decrypted from the service A connection and before it is encrypted for the service B connection. You can't keep it secret from the "other players" if they're operating the browser that is the middleman between service A and service B.

  • When you say the browser in the middle, you mean the users browser right? If so, that's entirely fine. Commented Jan 6, 2017 at 17:05
  • malicious extensions for example
    – beppe9000
    Commented May 31, 2018 at 15:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .