Questions tagged [crossdomain]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
41 views

Is it safe to allow linking to images by URL in user-made posts?

I'm working on an imageboard website that uses the TinyIB bulletin board software. When editing the settings, I found this line: define('TINYIB_UPLOADVIAURL', false); // Allow files to be uploaded via ...
AcinonX's user avatar
1 vote
1 answer
2k views

Set cookie inside iFrame domain not seen

I'm trying unsuccessfully to set a cookie in an iframe cross-domain. I've found elsewhere (https://stackoverflow.com/questions/2117248/setting-cookie-in-iframe-different-domain, https://stackoverflow....
Los Sol's user avatar
  • 11
0 votes
0 answers
240 views

Cross-domain login authentication

I am currently working as system integrator for a banking company, that asked me to provide an authentication integration on a third party website on which the company would like to redirect users, ...
Los Sol's user avatar
  • 11
2 votes
1 answer
156 views

What does COEP do that CSP doesn't already do?

Both Cross-Origin-Embedder-Policy and Content-Security-Policy seem to do pretty similar things: they restrict the document from loading certain types of subresources (e.g. cross-origin subresources). ...
Flying Penguin's user avatar
2 votes
2 answers
1k views

How to access CSRF token in fronted when API is on different domain?

I am building a website with a separate Javascript frontend and a Django backend. My backend uses CSRF protection. Now the problem is that the CSRF token is being set on the client side as a cookie on ...
atskdev's user avatar
  • 23
0 votes
1 answer
617 views

COOP and COEP: Is there an advantage to enabling COOP / COEP if I don't need to use the sharedArrayBuffer or other features?

COOP: cross origin opener policy COEP: Cross origin embedder policy Most of the articles on the web, related to COOP / COEP, point to the fact that by enabling COOP / COEP , your web page can use the ...
gaurav5430's user avatar
1 vote
0 answers
269 views

I have CSRF protection implemented server side, can I safely use `SameSite=None; Secure; HttpOnly`?

We have a web service where GET is always safe and all unsafe POST requests use single-use CSRF tokens. We have some cases where cross-origin domain would need to pass us POST request with data that ...
Mikko Rantalainen's user avatar
3 votes
1 answer
705 views

SubtleCrypto with non-extractable keys stored in IndexedDB - Cross Origin Usage

In a browser I want to use SublteCrypto (https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto) to create a key pair and store it locally in the IndexedDB (https://developer.mozilla.org/en-US/...
dominik's user avatar
  • 31
1 vote
1 answer
988 views

Is it secure to use window.origin with postMessage?

When using postMessage it's important to define a targetOrigin to ensure we don't leak data to other sites. It's equally important to check the origin when receiving a message to prevent other sites ...
Jamie G's user avatar
  • 111
0 votes
1 answer
196 views

Are there security issues around controlled cross site sharing behind SSO?

Very simply we have a ton of websites at our company behind SSO. I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
blankip's user avatar
  • 118
1 vote
2 answers
938 views

Cross-Domain Request is a CSRF Attack? (CORS)

CORS is a HTTP Suite header that “relax” the SOP. One of the CORS misconfigurations is about to reflect without reg exp the “Origin” client header into “ACAO” response header. If it happens with “ACAC:...
Zefiro38's user avatar
6 votes
4 answers
8k views

How to securely set a cookie on another subdomain?

I have a microservice app. hub.example.com handles authentication. When a users logs in, I need to set a cookie on learn.example.com What is a secure way to set this? I'm aware of a few approaches: ...
paj28's user avatar
  • 33.1k
3 votes
1 answer
2k views

Is there any way to access the contents of a cross domain iframe

I found that a subdomain of a site leaks all cookies of the site due to improper error handling. Now, I found that this site does not have X-Frame Options Header in it. So, I put this subdomain in the ...
Phenomenal One's user avatar
6 votes
1 answer
306 views

Why was the Same-origin policy originally introduced (before XMLHttpRequest)?

As I understand it, the Same-origin policy (SOP) basically prevents a script in a web page from obtaining or sending information from/to a different domain. I understand that this is important to ...
sleske's user avatar
  • 1,643
1 vote
1 answer
176 views

How did a malicious website managed to serve me the app that is running on my local apache server?

Today I accidentally miss-typed a popular's website domain, which led me to a malicious website. I realized immediately but before I had time to close the tab, I was surprised to be presented with the ...
pppfff604's user avatar
7 votes
2 answers
2k views

Why are cookies sent with HTML page's cross domain requests but not with JS's XHR?

When we write a HTML page with form tag and an action attribute and a submit button. As soon as we click on submit a request is sent (with cookies) to the URL which was the value of action attribute. ...
Nix's user avatar
  • 71
0 votes
1 answer
223 views

Inconsistent behavior while attempting to exploit a misconfigured flash crossdomain.xml

victim.com - URL of the misconfigured application. https://victim.com has an overly permissive crossdomain.xml at https://victim.com/crossdomain.xml. <?xml version="1.0"?> <!DOCTYPE cross-...
hax's user avatar
  • 3,901
1 vote
1 answer
3k views

security issues related to setting cookie using an <img> tag

Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B. Site B will return an image response, and in that response a cookie will be set (cookie of Site B's ...
void's user avatar
  • 113
1 vote
3 answers
773 views

How to stop app from fetching data from my website?

I am running a website that contains data that our users can access if they login. Someone else has created an Android app that lets users access that data as well. They enter their credentials, and ...
Tech2K's user avatar
  • 11
1 vote
1 answer
430 views

What's the purpose of the preflight check on CORS requests?

A fellow developer and I were experiencing a weird issue with our application in the past couple of days. Specifically, he's writing the API and I'm writing the web front end. Since the UI runs from ...
RLH's user avatar
  • 281
3 votes
1 answer
943 views

Is xhr.withCredentials making POST endpoints vulnerable to CSRF?

From what I've seen, someone can add the following code to a malicious site (lets say: http://sth.malicioussite.com) and be able to perform ajax post requests to a 3rd party site, along with any ...
Marinos An's user avatar
10 votes
1 answer
11k views

How to implement CSRF protection with a cross origin request (CORS)

tl;dr the Cookie-to-header-token method can't work due to the CSRF token cookie not being readable by the client in any way. Is sending the token in a header, and having the client save it in a cookie ...
Eran Medan's user avatar
15 votes
2 answers
4k views

How does medium.com know my google account?

I went to an article on medium.com earlier today, and instead of the annoying full screen popup they usually show to returning visitors, I saw this in the upper right corner: Right there on the ...
Alice Ryhl's user avatar
1 vote
2 answers
206 views

CORS clarification

I need some clarifications about the problems that CORS (Cross-Origin Resource Sharing) can cause. Let's suppose that site A.COM has enabled CORS, in particular: Access-Control-Allow-Origin can be ...
Edge7's user avatar
  • 130
1 vote
1 answer
867 views

Loading a logged in page in an iframe

Suppose www.youtube.com have no X-Frame-Options set. Imagine I'm already logged in to YouTube. Now from another web page in the same browser I'm loading YouTube in an iframe, will the browser send ...
3lokh's user avatar
  • 181
12 votes
2 answers
12k views

How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?

I need to implement an SSO solution with the following requirements: Cross-domain: Let's assume I have a.com, b.com and sso.com. If I become logged in through a.com, I shouldn't need to login when I ...
Jan Żankowski's user avatar
3 votes
2 answers
578 views

Automatic's Jetpack login auth....Why isn't this a security flaw?

I’m framing this question vis-a-vi Automatic and Jetpack, but I think it’s about something I don’t personally understand that is happening in a WordPress context, so I’m posting here. It’s not about ...
Jim Maguire's user avatar
1 vote
1 answer
356 views

what prevents sending "$.post" from one domain to another?

I have one website in chromium tab, and an other website in another tab, Im executing single post command in the second website - $.post(...); to the first website. Originaly its not working (getting: ...
Dannynis's user avatar
0 votes
2 answers
505 views

Setting Access-Control-Allow-Origin: * when session identifiers are injected in the HTTP headers

Is it considered as secure for an application to set a header access-control-allow-origin: * if during the normal usage of the application, the client credentials are injected in the headers by the JS ...
christophetd's user avatar
1 vote
1 answer
8k views

No Preflight Request is made during XHR cross-origin request

I made a XHR cross-origin request from a html file, hosted on a python Simple HTTP Server. var xhr = new XMLHttpRequest(); xhr.open("GET", "https://www.facebook.com/favicon.ico", true); xhr....
aka_007's user avatar
  • 79
5 votes
1 answer
4k views

Chrome extension: Cross origin request

Can chrome extensions make cross-origin requests by injecting a javascript into the main page? If so, isn't it a security vulnerability? Google Chrome Content Scripts Cross Origin Requests
Umar Iqbal's user avatar
9 votes
2 answers
5k views

How did the Facebook Originull vulnerablity of Access-Control-Allow-Origin: null allow cross-origin access?

Recently, a vulnerability in Facebook's messenger app which allowed attacks to access a users private messages via cross-origin AJAX was patched and disclosed. Simple Bug allows Hackers to Read all ...
Alexander O'Mara's user avatar
9 votes
1 answer
8k views

Security about window.opener and iframes

I have 3 domains : domainA domainB domainC If I set target="_blank" on domainA with a link to domainC, domainC can access a bunch of property of domainA. That's why I use target="_blank" rel="...
Xavier59's user avatar
  • 2,904
6 votes
2 answers
5k views

Cross domain iframe security

How exploitable is a site listening to browser messages from anyone? I am working on a site where I have found some iframe issues. The case is that site A has an iframe of site B, and site A listens ...
sboutzen's user avatar
5 votes
1 answer
5k views

How to check for cross-domain referrer leakage?

I am learning pen testing on web applications. I found the vulnerability cross-domain referrer leakage very interesting. Can anybody please tell me how to check for this vulnerability on any web ...
Webster's user avatar
  • 51
3 votes
1 answer
493 views

Access control allow origin browser protection efficiency

I was building a website as an experiment, and tried using few ajax requests to different sites. On some sites I will get an error: XMLHttpRequest cannot load http://example.com/path No 'Access-...
t0m9er's user avatar
  • 31
3 votes
1 answer
2k views

Is a Kerberos ticket valid with only one-way external trust between domains?

The situation is that I have two domains (Domain A and Domain B) that live on separate networks. I need to allow users in B to be authenticated with integrated windows authentication (IWA) when they ...
Doc Rinehart's user avatar
1 vote
1 answer
1k views

Secure crossdomain for rtmp/flash streaming/wowza

I've been a bit lost. I have the following situation: Flash Player file is on https://sub.example.com/player.swf crossdomain.xml is on https://sub2.example.com/crossdomain.xml Streaming is done ...
user857990's user avatar
4 votes
1 answer
2k views

What are the security implications of enabling CORS for images?

The company I work for runs a user profile photo server. I would like to fetch, visually modify (add a blur, some effects, etc.), and display those images in <canvas>. The problem is that the ...
Oleg's user avatar
  • 189
2 votes
1 answer
3k views

Cross-domain session standardization

I am looking into cross-domain sessions. These are sessions which are shared between two domains like google.com and spotify.com. I'm not looking for information regarding cross-domain sessions ...
Silver's user avatar
  • 1,820
3 votes
2 answers
1k views

Is crossdomain policy file required by EVERY web application?

1) If a web application does NOT use any Flash content, does it require crossdomain / clientacess policy file ? 2) If a web application does not host crossdomain / clientaccess policy file, is it ...
Kshitij Desai's user avatar
3 votes
1 answer
587 views

Single Page Application with REST API backend based on XML, queried by dynamic XPath

A web application I'm developing will be a Single Page Application (SPA) that will interact with a REST API backend, through jQuery.ajax() calls. The SPA and API will both be served over an https/TLS ...
Decent Dabbler's user avatar
2 votes
1 answer
191 views

OpenID Connect: API access using same identity provider

Does OpenID Connect support the following SSO-like scheme: Both website S and some meta-website M support login using OpenID Connect, e.g. with a Google account. Is it possible for M to access a user'...
mh8020's user avatar
  • 245
4 votes
3 answers
3k views

3rd party API access: Is OAuth really required?

Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, ...
mh8020's user avatar
  • 245
4 votes
2 answers
471 views

Is the following authentication solution safe or am I missing something?

Context: I have two web servers ServerA (LAMP stack) and ServerB (ASP.NET stack). I think the technology (hopefully) does not matter. Both servers require authentication and supposedly doing their ...
g.pickardou's user avatar
1 vote
1 answer
840 views

Would the CORS specification consider a missing Content-Type header to imply a "simple header"?

RFC 7231, Section 3.1.1.5 states: A sender that generates a message containing a payload body SHOULD generate a Content-Type header field in that message unless the intended media type of the ...
Parker's user avatar
  • 400
2 votes
1 answer
41k views

Accesssing cookies of another domain using Iframes and Javascript

Using Iframe we can embed webpages of another domain provided the X-Frame-Options isn't set to SAMEORIGIN. This also loads the cookie inside the iframe. Now, one can access this cookie if it's in the ...
aka_007's user avatar
  • 79
83 votes
6 answers
39k views

How does CORS prevent XSS?

I recently learned about CORS and got the impression that its purpose is to prevent XSS. With CORS, the browser blocks requests to different domains, unless particular headers are in place. But if a ...
Gigi's user avatar
  • 1,310
1 vote
1 answer
422 views

When is CORS applied?

I'm including some RUM (Real User Monitoring) JavaScript on a client's website that beacons back performance info. I was expecting to run into CORS issues but it seems to be working without any ...
bcooper's user avatar
  • 13
66 votes
6 answers
43k views

Is CORS helping in anyway against Cross-Site Forgery?

I've been reading in the last couple of days about CORS and in a lot of places it's mentioned as it is a "Security" feature to help the world from cross domain forgery. I still don't see the benefit ...
Dan Dinu's user avatar
  • 769