I have wrote an assignment for a course I am studying regarding social plugins like what you get with Facebook/Twitter, etc. With these platforms the user is directed to a seperate tab/window to confirm their action.

In my assignment I wrote another option. for example, Using the window.confirm function. With the sample code below.

function socialsubmit() {
    var submMsg = 'Confirm your submission';
    if (self !== top && !window.confirm(SubmMsg)) {
    sendXhr('\/social/subm', 'Type=request&' + 'itemIds=%token%', function(status) {
        document.getElementById(status == 0 ? 'sendSuccess' : 'sendError').style.display = '';
    }, true);

<button id="submButton">Submit 
    <script type="text/javascript" token="%tokenid%">document.getElementById('submButton').addEventListener('click', socialsubmit);</script>

Ignore if the code validates, I am just questioning whether the window.confirm is secure or not.

I said that the social button can be iframed onto the target site, then when the user wishes to perform the social action (submitting the form in the iframed site), the code above will execute a confirmation message preventing the user from being click jacked.

However, my report said that my method wasn't secure but I do not know why. Is their a security issue with using window.confirm to prevent click jacking?

Thank you for any advice.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.