I'm creating a web site that lets people create their own site using a subdomain. Are there any security implications by letting people add custom javascript to their pages? If so, which ones? XSS? Cookie sniffing? Could I make it work by sanitising the html?

Right now I'm disallowing it, but it'd be great to let people decide for themselves. I've noticed Github hosted pages have user entered javascript on them.

  • possible duplicate of User entered Javascript security implications – user10211 May 18 '13 at 12:23
  • 1
    @TerryChia - It's a duplicate no doubt about it, but this one is older and has one answer already from Stephen (probably from before it was migrated, Stephen is running for a moderator on Webmasters). I'm voting to close the other one and leaving this one open. ;) – TildalWave May 18 '13 at 13:49
  • 3
    Also cross-posted and already answered here: stackoverflow.com/q/16623188/321790 – Xander May 18 '13 at 14:21

The Same Origin Policy for DOM access isolates sub-domains, therefor the impact of XSS is isolated to a specific sub-domain. The Same Origin Policy for Cookie scope isolates sub-domains in that they cannot read or write another sub-domain's cookies. Just make sure your main site is www.site.com and no cookie is scoped to *.site.com, as this would be accessible (if it was an HTTPOnly cookie, it would not be accessible from JavaScript regardless of its scope).

  • Spot on! +1 for mentioning the issue with subdomains. – Adi May 18 '13 at 19:19

Allowing user entered Javascript is pretty much the definition of Cross Site Scripting (XSS).

The story of the Samy Myspace Worm is a great illustration of what can happen when a user can upload Javascript onto your site. Myspace wanted to allow sanitized HTML, but the hacker found a way to get around it. He put some Javascript in that caused anybody who viewed his profile to "friend" him and post the javascript on their own profile.

  • 2
    Yes, but what if this JavaScript is on its own subdomain? You missed a vital part of this question. – rook May 18 '13 at 19:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.