2022 Developer Survey is open! Take survey.

Questions tagged [crossdomain]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
88 views

COOP and COEP: Is there an advantage to enabling COOP / COEP if I don't need to use the sharedArrayBuffer or other features?

COOP: cross origin opener policy COEP: Cross origin embedder policy Most of the articles on the web, related to COOP / COEP, point to the fact that by enabling COOP / COEP , your web page can use the ...
user avatar
0 votes
0 answers
108 views

I have CSRF protection implemented server side, can I safely use `SameSite=None; Secure; HttpOnly`?

We have a web service where GET is always safe and all unsafe POST requests use single-use CSRF tokens. We have some cases where cross-origin domain would need to pass us POST request with data that ...
user avatar
0 votes
0 answers
137 views

X-Permitted-Cross-Domain-Policies - allow certain URL patterns

I have a website where I am blocking it from being loaded via iframe into other websites. What I want is to keep this in place, but allow certain URLs from my website, to be iframed anywhere. For ...
user avatar
2 votes
1 answer
251 views

SubtleCrypto with non-extractable keys stored in IndexedDB - Cross Origin Usage

In a browser I want to use SublteCrypto (https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto) to create a key pair and store it locally in the IndexedDB (https://developer.mozilla.org/en-US/...
user avatar
  • 21
1 vote
1 answer
314 views

Is it secure to use window.origin with postMessage?

When using postMessage it's important to define a targetOrigin to ensure we don't leak data to other sites. It's equally important to check the origin when receiving a message to prevent other sites ...
user avatar
  • 111
0 votes
1 answer
171 views

Are there security issues around controlled cross site sharing behind SSO?

Very simply we have a ton of websites at our company behind SSO. I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
user avatar
  • 108
1 vote
2 answers
580 views

Cross-Domain Request is a CSRF Attack? (CORS)

CORS is a HTTP Suite header that “relax” the SOP. One of the CORS misconfigurations is about to reflect without reg exp the “Origin” client header into “ACAO” response header. If it happens with “ACAC:...
user avatar
4 votes
4 answers
5k views

How to securely set a cookie on another subdomain?

I have a microservice app. hub.example.com handles authentication. When a users logs in, I need to set a cookie on learn.example.com What is a secure way to set this? I'm aware of a few approaches: ...
user avatar
  • 32.6k
4 votes
1 answer
1k views

Is there any way to access the contents of a cross domain iframe

I found that a subdomain of a site leaks all cookies of the site due to improper error handling. Now, I found that this site does not have X-Frame Options Header in it. So, I put this subdomain in the ...
user avatar
6 votes
1 answer
225 views

Why was the Same-origin policy originally introduced (before XMLHttpRequest)?

As I understand it, the Same-origin policy (SOP) basically prevents a script in a web page from obtaining or sending information from/to a different domain. I understand that this is important to ...
user avatar
  • 1,617
1 vote
1 answer
168 views

How did a malicious website managed to serve me the app that is running on my local apache server?

Today I accidentally miss-typed a popular's website domain, which led me to a malicious website. I realized immediately but before I had time to close the tab, I was surprised to be presented with the ...
user avatar
6 votes
2 answers
1k views

Why are cookies sent with HTML page's cross domain requests but not with JS's XHR?

When we write a HTML page with form tag and an action attribute and a submit button. As soon as we click on submit a request is sent (with cookies) to the URL which was the value of action attribute. ...
user avatar
  • 61
1 vote
1 answer
189 views

Inconsistent behavior while attempting to exploit a misconfigured flash crossdomain.xml

victim.com - URL of the misconfigured application. https://victim.com has an overly permissive crossdomain.xml at https://victim.com/crossdomain.xml. <?xml version="1.0"?> <!DOCTYPE cross-...
user avatar
  • 3,851
1 vote
1 answer
2k views

security issues related to setting cookie using an <img> tag

Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B. Site B will return an image response, and in that response a cookie will be set (cookie of Site B's ...
user avatar
  • 113
1 vote
3 answers
516 views

How to stop app from fetching data from my website?

I am running a website that contains data that our users can access if they login. Someone else has created an Android app that lets users access that data as well. They enter their credentials, and ...
user avatar
  • 11
1 vote
1 answer
330 views

What's the purpose of the preflight check on CORS requests?

A fellow developer and I were experiencing a weird issue with our application in the past couple of days. Specifically, he's writing the API and I'm writing the web front end. Since the UI runs from ...
user avatar
  • 301
3 votes
1 answer
691 views

Is xhr.withCredentials making POST endpoints vulnerable to CSRF?

From what I've seen, someone can add the following code to a malicious site (lets say: http://sth.malicioussite.com) and be able to perform ajax post requests to a 3rd party site, along with any ...
user avatar
8 votes
1 answer
8k views

How to implement CSRF protection with a cross origin request (CORS)

tl;dr the Cookie-to-header-token method can't work due to the CSRF token cookie not being readable by the client in any way. Is sending the token in a header, and having the client save it in a cookie ...
user avatar
15 votes
2 answers
3k views

How does medium.com know my google account?

I went to an article on medium.com earlier today, and instead of the annoying full screen popup they usually show to returning visitors, I saw this in the upper right corner: Right there on the ...
user avatar
1 vote
2 answers
186 views

CORS clarification

I need some clarifications about the problems that CORS (Cross-Origin Resource Sharing) can cause. Let's suppose that site A.COM has enabled CORS, in particular: Access-Control-Allow-Origin can be ...
user avatar
  • 130
1 vote
1 answer
542 views

Loading a logged in page in an iframe

Suppose www.youtube.com have no X-Frame-Options set. Imagine I'm already logged in to YouTube. Now from another web page in the same browser I'm loading YouTube in an iframe, will the browser send ...
user avatar
  • 181
12 votes
2 answers
9k views

How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?

I need to implement an SSO solution with the following requirements: Cross-domain: Let's assume I have a.com, b.com and sso.com. If I become logged in through a.com, I shouldn't need to login when I ...
user avatar
3 votes
2 answers
573 views

Automatic's Jetpack login auth....Why isn't this a security flaw?

I’m framing this question vis-a-vi Automatic and Jetpack, but I think it’s about something I don’t personally understand that is happening in a WordPress context, so I’m posting here. It’s not about ...
user avatar
1 vote
1 answer
290 views

what prevents sending "$.post" from one domain to another?

I have one website in chromium tab, and an other website in another tab, Im executing single post command in the second website - $.post(...); to the first website. Originaly its not working (getting: ...
user avatar
0 votes
2 answers
499 views

Setting Access-Control-Allow-Origin: * when session identifiers are injected in the HTTP headers

Is it considered as secure for an application to set a header access-control-allow-origin: * if during the normal usage of the application, the client credentials are injected in the headers by the JS ...
user avatar
1 vote
1 answer
7k views

No Preflight Request is made during XHR cross-origin request

I made a XHR cross-origin request from a html file, hosted on a python Simple HTTP Server. var xhr = new XMLHttpRequest(); xhr.open("GET", "https://www.facebook.com/favicon.ico", true); xhr....
user avatar
  • 79
5 votes
1 answer
4k views

Chrome extension: Cross origin request

Can chrome extensions make cross-origin requests by injecting a javascript into the main page? If so, isn't it a security vulnerability? Google Chrome Content Scripts Cross Origin Requests
user avatar
9 votes
2 answers
5k views

How did the Facebook Originull vulnerablity of Access-Control-Allow-Origin: null allow cross-origin access?

Recently, a vulnerability in Facebook's messenger app which allowed attacks to access a users private messages via cross-origin AJAX was patched and disclosed. Simple Bug allows Hackers to Read all ...
user avatar
9 votes
1 answer
7k views

Security about window.opener and iframes

I have 3 domains : domainA domainB domainC If I set target="_blank" on domainA with a link to domainC, domainC can access a bunch of property of domainA. That's why I use target="_blank" rel="...
user avatar
  • 2,894
6 votes
2 answers
5k views

Cross domain iframe security

How exploitable is a site listening to browser messages from anyone? I am working on a site where I have found some iframe issues. The case is that site A has an iframe of site B, and site A listens ...
user avatar
5 votes
1 answer
4k views

How to check for cross-domain referrer leakage?

I am learning pen testing on web applications. I found the vulnerability cross-domain referrer leakage very interesting. Can anybody please tell me how to check for this vulnerability on any web ...
user avatar
  • 51
3 votes
1 answer
478 views

Access control allow origin browser protection efficiency

I was building a website as an experiment, and tried using few ajax requests to different sites. On some sites I will get an error: XMLHttpRequest cannot load http://example.com/path No 'Access-...
user avatar
  • 31
3 votes
1 answer
2k views

Is a Kerberos ticket valid with only one-way external trust between domains?

The situation is that I have two domains (Domain A and Domain B) that live on separate networks. I need to allow users in B to be authenticated with integrated windows authentication (IWA) when they ...
user avatar
1 vote
1 answer
1k views

Secure crossdomain for rtmp/flash streaming/wowza

I've been a bit lost. I have the following situation: Flash Player file is on https://sub.example.com/player.swf crossdomain.xml is on https://sub2.example.com/crossdomain.xml Streaming is done ...
user avatar
4 votes
1 answer
1k views

What are the security implications of enabling CORS for images?

The company I work for runs a user profile photo server. I would like to fetch, visually modify (add a blur, some effects, etc.), and display those images in <canvas>. The problem is that the ...
user avatar
  • 189
2 votes
1 answer
3k views

Cross-domain session standardization

I am looking into cross-domain sessions. These are sessions which are shared between two domains like google.com and spotify.com. I'm not looking for information regarding cross-domain sessions ...
user avatar
  • 1,824
3 votes
2 answers
1k views

Is crossdomain policy file required by EVERY web application?

1) If a web application does NOT use any Flash content, does it require crossdomain / clientacess policy file ? 2) If a web application does not host crossdomain / clientaccess policy file, is it ...
user avatar
3 votes
1 answer
538 views

Single Page Application with REST API backend based on XML, queried by dynamic XPath

A web application I'm developing will be a Single Page Application (SPA) that will interact with a REST API backend, through jQuery.ajax() calls. The SPA and API will both be served over an https/TLS ...
user avatar
2 votes
1 answer
179 views

OpenID Connect: API access using same identity provider

Does OpenID Connect support the following SSO-like scheme: Both website S and some meta-website M support login using OpenID Connect, e.g. with a Google account. Is it possible for M to access a user'...
user avatar
  • 225
4 votes
3 answers
3k views

3rd party API access: Is OAuth really required?

Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, ...
user avatar
  • 225
4 votes
2 answers
454 views

Is the following authentication solution safe or am I missing something?

Context: I have two web servers ServerA (LAMP stack) and ServerB (ASP.NET stack). I think the technology (hopefully) does not matter. Both servers require authentication and supposedly doing their ...
user avatar
1 vote
1 answer
706 views

Would the CORS specification consider a missing Content-Type header to imply a "simple header"?

RFC 7231, Section 3.1.1.5 states: A sender that generates a message containing a payload body SHOULD generate a Content-Type header field in that message unless the intended media type of the ...
user avatar
2 votes
1 answer
38k views

Accesssing cookies of another domain using Iframes and Javascript

Using Iframe we can embed webpages of another domain provided the X-Frame-Options isn't set to SAMEORIGIN. This also loads the cookie inside the iframe. Now, one can access this cookie if it's in the ...
user avatar
  • 79
79 votes
6 answers
32k views

How does CORS prevent XSS?

I recently learned about CORS and got the impression that its purpose is to prevent XSS. With CORS, the browser blocks requests to different domains, unless particular headers are in place. But if a ...
user avatar
  • 1,260
1 vote
1 answer
388 views

When is CORS applied?

I'm including some RUM (Real User Monitoring) JavaScript on a client's website that beacons back performance info. I was expecting to run into CORS issues but it seems to be working without any ...
user avatar
  • 13
59 votes
6 answers
37k views

Is CORS helping in anyway against Cross-Site Forgery?

I've been reading in the last couple of days about CORS and in a lot of places it's mentioned as it is a "Security" feature to help the world from cross domain forgery. I still don't see the benefit ...
user avatar
  • 699
1 vote
1 answer
4k views

Best way to deal with cross-domain authentication in intranet

Firstly, I'm not sure if this is valid board to ask this question - maybe it should be asked on StackOverflow? Overview on use-case, what we trying to achieve: Two servers, on two different domains; ...
user avatar
  • 121
4 votes
1 answer
4k views

Crossdomain.xml vulnerabilities

<cross-domain-policy> <allow-access-from domain="*" secure="false"/> <site-control permitted-cross-domain-policies="master-only"/> </cross-domain-policy> I would like to ask ...
user avatar
23 votes
2 answers
52k views

Can a website make an HTTP request to "localhost"? How does it get around the cross-domain policy?

I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability. The website in question has a "patch me" button, and if you have a password-less Redis ...
user avatar
3 votes
2 answers
1k views

Will a crossdomain.xml file reduce a potential security risk?

I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
user avatar
  • 6,200