How to prevent self-XSS?

Question

I am creating a website which solely uses REST api for all the features and functionality, from signup and login to fetching data and populating the webpage using Mustache as template engine for objects.

Authentication is token based in which token dynamically added to header using JS functions to prevent CSRF attack. All the functions when interacting with user input data has sanitizers to prevent XSS attack. So basically every valid action has an associated JS function associated with it with XSS and CSRF protection enabled.

What if a user want's to bypass these functions and run his own functions from the console performing the same actions without XSS protections. One option is to implement server side XSS protection.

Now what if someone tries to trick users to paste some JS code in console which essentially has access to authentication tokens and can perform undesired requests which can harm the user. How to mitigate this attack or is there a way to prevent or identify such actions?

Answer 1

what if someone tries to trick users to paste some JS code in console

What if someone tricks users into installing malware on their computer?
What if someone dials a fake tech support number after encountering an issue with your website, and the scammers do something evil to the user's account on your website?
What if people on 4chan post about fast, wireless charging smartphones in a microwave, and people actually try it and destroy their phone?

I think this falls in the category "outside of your control", at least as far as technical measures go.

Injecting custom code into a developer's console is not something you can effectively protect against, unless it's within your own (or a client's) company and you can impose/recommend a company policy to disable the console in browsers for non-developers or something. And even then, it's probably more of a nuisance to legitimate users than truly useful.

What you can do is educate and inform people. It's not limited to self-XSS: if I ask you to paste some code into a text file and rename it to vbs, then you have the exact same issue. Running untrusted code is the problem here, not just the trendily-named self-XSS.

Answer 2

There is no way to distinguis an API call made from the "real" app from one made from the console. The server only sees the HTTP request, and it looks exactly the same. There really isn't anything you can do here.

Self XSS is not a vulnerability in your site, and hence you can not fix it. It is a vulnerability in the browser, or perhaps rather in people. The ones who can make a difference here are the browser vendors - and in fact, they have. The first time you fire up the console (at least in Firefox), it gives you a warning explaining that this is a dangerous place and you should not just copy paste things here.

Answer 3

Some sites like facebook print a big fat warning on the developer console (I think just using console.log) explaining users that they should never ever paste code there.

Answer 4

Like what Luc has said, it is impossible to completely prevent XSS, or anything security-related actually.

However, unlike the other answers which state that you only can display a visual warning using console.log(), it is actually possible to disable the console altogether - see this post for the full details. It is a bad idea to rely on client-side protection against XSS though.

Using this code from the linked post, you'll be able to disable the developer console on the client-side:

Object.defineProperty(window, "console", {
    value: console,
    writable: false,
    configurable: false
});

var i = 0;
function showWarningAndThrow() {
    if (!i) {
        setTimeout(function () {
            console.log("%cWarning message", "font: 2em sans-serif; color: yellow; background-color: red;");
        }, 1);
        i = 1;
    }
    throw "Console is disabled";
}

var l, n = {
        set: function (o) {
            l = o;
        },
        get: function () {
            showWarningAndThrow();
            return l;
        }
    };
Object.defineProperty(console, "_commandLineAPI", n);
Object.defineProperty(console, "__commandLineAPI", n);