What kind of attack are prevented by running code submitted by the user in a Javascript Web Worker? Do they prevent attacks like XSS, or is it better to use some other sandboxing method to protect against most vulnerabilities?

  • 1
    I had a quick look at WebWorker and it doesn't look like a security feature? AFAIK, it's a way to implement background tasks. Possibly related: stackoverflow.com/questions/16600607/… – tangrs Jul 22 '15 at 3:41
  • XSS is probably the least of your security concerns if you're running user-written Javascript. – Neil Smithline Jul 22 '15 at 4:05
up vote 0 down vote accepted

It looks like WebWorkers are not a security feature, but simply a way to run background threads on the client side of the web application. This means they don't protect you from any existing attacks but they may instead introduce new attack vectors :(

Of interest in this regard might be the communication between the workers and the main thread: they are reusing the postMessage interface which was originally used to communicate between different frames. By using the same interface it also adds the same security issues. This means you should check for the origin of a received message in your message event handler. The example code you will find for web workers usually does not do this.

  • Thanks for the answer! I do know that web workers aren't designed to be a security feature, but I looked at several posts here and many people recommended using them for sandboxing. I guess that's what I get for listening to what people on the Internet say, eh? – CivvyThePandaTM Jul 22 '15 at 11:57
  • @CivvyThePandaTM: they are not wrong and you can do some limited sandboxing using WebWorkers since they don't have access to the document. But since this is more a side effect of how they work was not explicitly introduced as a security feature I would not trust it fully. – Steffen Ullrich Jul 22 '15 at 13:21

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.