I am part way through creating a 3rd party service for an online game. Currently to pull the game data from outside the game I use my own auth cookies, however, I want to make this available for other players to use to see their personal stats and what not.

I can send the cookies from the game via a userscript or plugin. However, I want to ensure I'm handling their information securely. The cookies are stored in an AES encrypted table.

When sending from a userscript to a webserver via a XMLHTTP request, how can you ensure the security of the data during transit? Does SSL work when sending cross-domain?

If I understand correctly, you want to to have service A hand a cookie to the user's browser which is then submitted to service B, and you want that cookie to be secure throughout.

As far as network transit goes, if both service A and service B are enforcing SSL, then yes, it will be encrypted "in transit". But you (service A) may not have any control over whether service B uses SSL or not.

In any case, the actual browser in the middle will have access to that data, after it is decrypted from the service A connection and before it is encrypted for the service B connection. You can't keep it secret from the "other players" if they're operating the browser that is the middleman between service A and service B.

  • When you say the browser in the middle, you mean the users browser right? If so, that's entirely fine. – Douglas Gaskell Jan 6 '17 at 17:05
  • malicious extensions for example – beppe9000 May 31 at 15:45

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.