This blog is describing a way to hide the referer header in various situations. Specifically he is referring to things that run in the about:blank context.

  • What is the about:blank context?

  • How does about:blank, 307 redirect, and CORS relate to this? (or how would I determine this outside of the blog?)

  • Are there additional things that run in the about:blank context besides those listed?

  • Are there other security contexts that run in parallel to about:blank?

  • First of all i don't think its possible to run JS in about:blank (or the local security context) unless you have an 0-day... That being said, about:blank probably isn't useful to anyone. – rook Mar 29 '13 at 16:22
  • @rook I'm soon going to experiment with an iFrame with src=about:blank. Test cases and other ideas are welcome – halfbit Mar 29 '13 at 16:41
  • Beware when you use about:blank in an https website. The about:blank is in a different zone and some browsers will throw an annoying warning about 'mixed content' – Jeff Mar 29 '13 at 16:54
  • In the case of data URI's, IIRC each URI seems isolated from every other. I.e. data:text/html;,foo cannot contact data:text/html;,bar. This may then also apply to about:'s – Henning Klevjer Apr 1 '13 at 12:08

The about:blank is just a blank address-less browser screen, that will inherit the same security parameters of its caller. That said, you cannot exploit about:blank to bridge the JavaScript cross-domain access restrictions if thats what you're asking.

Despite its location is not part of your domain, it belongs to it, and will not run stuff in a different security level.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.