0

I want to know if there is a way for JS from one Origin to delegate a task to JS from another origin in a secure way.

The use case is to have a JS Agent from the users' home origin use the JavaScript Web Crypto API, to save the key in the browser storage in a safe manner.

Other Apps should then be able to make request to that JS agent to sign specific things for identification purposes with that key. This would allow authorizing services to distinguish between the App authenticating for the user, and the user authenticating a request made by that App. More details.

Is there a standard way to do this correctly now?

Improve this question
8
  • 3
    I'm not sure what you are asking: the title asks about cross-origin communication which is possible with postMessage and which can also be properly secured (verification if input matches expectations). The first line of the body asks about delegating tasks cross-origin which is different to just communication as in the title. And the references you provide are about sharing information between cross-origin iframes in a more formalized way by attaching policies while sharing. It would be more useful if you would describe the actual problem you are trying to solve.
    – Steffen Ullrich
    Sep 24, 2019 at 16:01
  • Also, what is the intention for setting the cryptography tag on the question? I cannot see any obvious relation.
    – Steffen Ullrich
    Sep 24, 2019 at 16:05
  • The idea would be to have an application from one origin do cryptographic signing of specific data on request from another.
    – bblfish
    Sep 24, 2019 at 16:12
  • 1
    It might be more useful if you would provide the detailed use case in your question instead of showing only a glimpse into it in the comment. And when doing this you might also delete the parts of your question which are not clearly related to this use case or alternatively make it clear how they are related. And don't forget to let the title match your actual question.
    – Steffen Ullrich
    Sep 24, 2019 at 16:24
  • 1
    two safe one-way transports: window.name and location.hash
    – dandavis
    Sep 24, 2019 at 20:50

2 Answers 2

Reset to default
1

I can see two options here.

The first is to just delegate the crypto part to a server, and communicate with it via a HTTP API. This wouldn't involve the JS web crypto API, and perhaps it would violate some of your design criteria.

Second option for communicating across origins is Window.postMessage(). It let's you send messages and receive responses between different window objects in different origins. It is largely up to you to enforce security here:

If you do expect to receive messages from other sites, always verify the sender's identity using the origin and possibly source properties. Any window (including, for example, http://evil.example.com) can send a message to any other window, and you have no guarantees that an unknown sender will not send malicious messages. Having verified identity, however, you still should always verify the syntax of the received message. Otherwise, a security hole in the site you trusted to send only trusted messages could then open a cross-site scripting hole in your site.

Always specify an exact target origin, not *, when you use postMessage to send data to other windows. A malicious site can change the location of the window without your knowledge, and therefore it can intercept the data sent using postMessage.

Note that an XSS vulnerability in any page you accept messages from will let an attacker post messages to your origin.

Improve this answer
0

I'll add a post to technologies for which this could be a use case but which have not made it. Some of these look like they could have been very helpful.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .