1

I have a web application that retrieves HTML snippets from the server and places them on the page, using JavaScript. The server responds with a small part of a HTML document. What Content-Type header should I use? Marking it as text/html may lead to attacks where the snippet is accessed directly by the browser, without the intended context. Is there something like text/html+snippet? Should I mark them as HTML and secure them otherwise, e.g. by using a Content-Security-Policy: sandbox or Content-Disposition: attachment to prevent rendering them in the browser?

E.g. I have the following page on /snippets/welcome.php:

<?php
echo 'Welcome <b>'.htmlentities($_GET['name']).'</b>';

I load this in my web application using htmx or jQuery.load. However, I don't want an attacker to be able to do content injection and phishing a user, by luring a user to /snippets/welcome.php?name=dear+user,[email protected]. This page is not meant to be accessed directly in a browser, and for security reasons it shouldn't be.

1
  • Are you only interested in preventing browser from interpreting your page?
    – Shireheart
    Commented Sep 4, 2023 at 13:34

1 Answer 1

1

The Content-Type header should be the solution to your problem.

Setting this header to text/plain should prevent browsers from interpreting the content as HTML, thus avoiding rendering.

This would prevent the attack scenario that you mentioned; a request to the service by a browser would not be rendered as HTML, the phishing would be more difficult to perform with plain text.

I would also be careful of if the input submitted to the snippet service contains user submitted data. If it does, ensure that you encode it properly (HTML entities, CSS encoding...) depending on where you include the data in your snippet.

However, it is still (in my opinion) undesirable to have an exposed service that reply anything you send to it. I can suggest the following measures:

  • Require authentication to access the snippet service (this is the best advice I think),
  • Only allow a whitelist of allowed inputs,
  • Limit the size of the input, restrict the character set available.

On a final note, I'm not sure that the CSP would help with your concern here, nor would the Content-Disposition header.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .