Skip to main content

Questions tagged [crossdomain]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
277 views

Are there security issues around controlled cross site sharing behind SSO?

Very simply we have a ton of websites at our company behind SSO. I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
1 vote
2 answers
8k views

Set cookie inside iFrame domain not seen

I'm trying unsuccessfully to set a cookie in an iframe cross-domain. I've found elsewhere (https://stackoverflow.com/questions/2117248/setting-cookie-in-iframe-different-domain, https://stackoverflow....
69 votes
7 answers
48k views

Is CORS helping in anyway against Cross-Site Forgery?

I've been reading in the last couple of days about CORS and in a lot of places it's mentioned as it is a "Security" feature to help the world from cross domain forgery. I still don't see the benefit ...
0 votes
1 answer
109 views

Is it safe to allow linking to images by URL in user-made posts?

I'm working on an imageboard website that uses the TinyIB bulletin board software. When editing the settings, I found this line: define('TINYIB_UPLOADVIAURL', false); // Allow files to be uploaded via ...
0 votes
0 answers
419 views

Cross-domain login authentication

I am currently working as system integrator for a banking company, that asked me to provide an authentication integration on a third party website on which the company would like to redirect users, ...
3 votes
1 answer
1k views

SubtleCrypto with non-extractable keys stored in IndexedDB - Cross Origin Usage

In a browser I want to use SublteCrypto (https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto) to create a key pair and store it locally in the IndexedDB (https://developer.mozilla.org/en-US/...
2 votes
2 answers
2k views

How to access CSRF token in fronted when API is on different domain?

I am building a website with a separate Javascript frontend and a Django backend. My backend uses CSRF protection. Now the problem is that the CSRF token is being set on the client side as a cookie on ...
84 votes
6 answers
42k views

How does CORS prevent XSS?

I recently learned about CORS and got the impression that its purpose is to prevent XSS. With CORS, the browser blocks requests to different domains, unless particular headers are in place. But if a ...
4 votes
1 answer
364 views

What does COEP do that CSP doesn't already do?

Both Cross-Origin-Embedder-Policy and Content-Security-Policy seem to do pretty similar things: they restrict the document from loading certain types of subresources (e.g. cross-origin subresources). ...
0 votes
1 answer
952 views

COOP and COEP: Is there an advantage to enabling COOP / COEP if I don't need to use the sharedArrayBuffer or other features?

COOP: cross origin opener policy COEP: Cross origin embedder policy Most of the articles on the web, related to COOP / COEP, point to the fact that by enabling COOP / COEP , your web page can use the ...
1 vote
0 answers
352 views

I have CSRF protection implemented server side, can I safely use `SameSite=None; Secure; HttpOnly`?

We have a web service where GET is always safe and all unsafe POST requests use single-use CSRF tokens. We have some cases where cross-origin domain would need to pass us POST request with data that ...
8 votes
2 answers
2k views

Why are cookies sent with HTML page's cross domain requests but not with JS's XHR?

When we write a HTML page with form tag and an action attribute and a submit button. As soon as we click on submit a request is sent (with cookies) to the URL which was the value of action attribute. ...
23 votes
2 answers
59k views

Can a website make an HTTP request to "localhost"? How does it get around the cross-domain policy?

I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability. The website in question has a "patch me" button, and if you have a password-less Redis ...
1 vote
2 answers
1k views

Cross-Domain Request is a CSRF Attack? (CORS)

CORS is a HTTP Suite header that “relax” the SOP. One of the CORS misconfigurations is about to reflect without reg exp the “Origin” client header into “ACAO” response header. If it happens with “ACAC:...
2 votes
1 answer
2k views

Is it secure to use window.origin with postMessage?

When using postMessage it's important to define a targetOrigin to ensure we don't leak data to other sites. It's equally important to check the origin when receiving a message to prevent other sites ...
2 votes
1 answer
11k views

Cross Domain Javascript security [duplicate]

I used a web vulnerability scanner to scan my web site. It indicates several links with "Cross domain Java script source file inclusion." May I know how would an attacker exploit this type of ...
7 votes
4 answers
10k views

How to securely set a cookie on another subdomain?

I have a microservice app. hub.example.com handles authentication. When a users logs in, I need to set a cookie on learn.example.com What is a secure way to set this? I'm aware of a few approaches: ...
3 votes
1 answer
3k views

Is there any way to access the contents of a cross domain iframe

I found that a subdomain of a site leaks all cookies of the site due to improper error handling. Now, I found that this site does not have X-Frame Options Header in it. So, I put this subdomain in the ...
6 votes
1 answer
379 views

Why was the Same-origin policy originally introduced (before XMLHttpRequest)?

As I understand it, the Same-origin policy (SOP) basically prevents a script in a web page from obtaining or sending information from/to a different domain. I understand that this is important to ...
1 vote
1 answer
209 views

How did a malicious website managed to serve me the app that is running on my local apache server?

Today I accidentally miss-typed a popular's website domain, which led me to a malicious website. I realized immediately but before I had time to close the tab, I was surprised to be presented with the ...
12 votes
2 answers
14k views

How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?

I need to implement an SSO solution with the following requirements: Cross-domain: Let's assume I have a.com, b.com and sso.com. If I become logged in through a.com, I shouldn't need to login when I ...
0 votes
1 answer
254 views

Inconsistent behavior while attempting to exploit a misconfigured flash crossdomain.xml

victim.com - URL of the misconfigured application. https://victim.com has an overly permissive crossdomain.xml at https://victim.com/crossdomain.xml. <?xml version="1.0"?> <!DOCTYPE cross-...
1 vote
1 answer
4k views

security issues related to setting cookie using an <img> tag

Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B. Site B will return an image response, and in that response a cookie will be set (cookie of Site B's ...
1 vote
3 answers
948 views

How to stop app from fetching data from my website?

I am running a website that contains data that our users can access if they login. Someone else has created an Android app that lets users access that data as well. They enter their credentials, and ...
15 votes
2 answers
4k views

How does medium.com know my google account?

I went to an article on medium.com earlier today, and instead of the annoying full screen popup they usually show to returning visitors, I saw this in the upper right corner: Right there on the ...
9 votes
2 answers
6k views

How did the Facebook Originull vulnerablity of Access-Control-Allow-Origin: null allow cross-origin access?

Recently, a vulnerability in Facebook's messenger app which allowed attacks to access a users private messages via cross-origin AJAX was patched and disclosed. Simple Bug allows Hackers to Read all ...
1 vote
1 answer
521 views

What's the purpose of the preflight check on CORS requests?

A fellow developer and I were experiencing a weird issue with our application in the past couple of days. Specifically, he's writing the API and I'm writing the web front end. Since the UI runs from ...
3 votes
1 answer
1k views

Is xhr.withCredentials making POST endpoints vulnerable to CSRF?

From what I've seen, someone can add the following code to a malicious site (lets say: http://sth.malicioussite.com) and be able to perform ajax post requests to a 3rd party site, along with any ...
12 votes
1 answer
12k views

How to implement CSRF protection with a cross origin request (CORS)

tl;dr the Cookie-to-header-token method can't work due to the CSRF token cookie not being readable by the client in any way. Is sending the token in a header, and having the client save it in a cookie ...
3 votes
1 answer
620 views

Single Page Application with REST API backend based on XML, queried by dynamic XPath

A web application I'm developing will be a Single Page Application (SPA) that will interact with a REST API backend, through jQuery.ajax() calls. The SPA and API will both be served over an https/TLS ...
5 votes
1 answer
4k views

Chrome extension: Cross origin request

Can chrome extensions make cross-origin requests by injecting a javascript into the main page? If so, isn't it a security vulnerability? Google Chrome Content Scripts Cross Origin Requests
1 vote
2 answers
239 views

CORS clarification

I need some clarifications about the problems that CORS (Cross-Origin Resource Sharing) can cause. Let's suppose that site A.COM has enabled CORS, in particular: Access-Control-Allow-Origin can be ...
1 vote
1 answer
993 views

Loading a logged in page in an iframe

Suppose www.youtube.com have no X-Frame-Options set. Imagine I'm already logged in to YouTube. Now from another web page in the same browser I'm loading YouTube in an iframe, will the browser send ...
3 votes
2 answers
605 views

Automatic's Jetpack login auth....Why isn't this a security flaw?

I’m framing this question vis-a-vi Automatic and Jetpack, but I think it’s about something I don’t personally understand that is happening in a WordPress context, so I’m posting here. It’s not about ...
1 vote
1 answer
404 views

what prevents sending "$.post" from one domain to another?

I have one website in chromium tab, and an other website in another tab, Im executing single post command in the second website - $.post(...); to the first website. Originaly its not working (getting: ...
3 votes
1 answer
3k views

Is a Kerberos ticket valid with only one-way external trust between domains?

The situation is that I have two domains (Domain A and Domain B) that live on separate networks. I need to allow users in B to be authenticated with integrated windows authentication (IWA) when they ...
0 votes
2 answers
528 views

Setting Access-Control-Allow-Origin: * when session identifiers are injected in the HTTP headers

Is it considered as secure for an application to set a header access-control-allow-origin: * if during the normal usage of the application, the client credentials are injected in the headers by the JS ...
6 votes
2 answers
6k views

Cross domain iframe security

How exploitable is a site listening to browser messages from anyone? I am working on a site where I have found some iframe issues. The case is that site A has an iframe of site B, and site A listens ...
1 vote
1 answer
1k views

Secure crossdomain for rtmp/flash streaming/wowza

I've been a bit lost. I have the following situation: Flash Player file is on https://sub.example.com/player.swf crossdomain.xml is on https://sub2.example.com/crossdomain.xml Streaming is done ...
1 vote
1 answer
8k views

No Preflight Request is made during XHR cross-origin request

I made a XHR cross-origin request from a html file, hosted on a python Simple HTTP Server. var xhr = new XMLHttpRequest(); xhr.open("GET", "https://www.facebook.com/favicon.ico", true); xhr....
8 votes
1 answer
8k views

Security about window.opener and iframes

I have 3 domains : domainA domainB domainC If I set target="_blank" on domainA with a link to domainC, domainC can access a bunch of property of domainA. That's why I use target="_blank" rel="...
5 votes
1 answer
5k views

How to check for cross-domain referrer leakage?

I am learning pen testing on web applications. I found the vulnerability cross-domain referrer leakage very interesting. Can anybody please tell me how to check for this vulnerability on any web ...
3 votes
1 answer
519 views

Access control allow origin browser protection efficiency

I was building a website as an experiment, and tried using few ajax requests to different sites. On some sites I will get an error: XMLHttpRequest cannot load http://example.com/path No 'Access-...
3 votes
2 answers
1k views

Will a crossdomain.xml file reduce a potential security risk?

I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
4 votes
1 answer
2k views

What are the security implications of enabling CORS for images?

The company I work for runs a user profile photo server. I would like to fetch, visually modify (add a blur, some effects, etc.), and display those images in <canvas>. The problem is that the ...
2 votes
1 answer
3k views

Cross-domain session standardization

I am looking into cross-domain sessions. These are sessions which are shared between two domains like google.com and spotify.com. I'm not looking for information regarding cross-domain sessions ...
3 votes
2 answers
1k views

Is crossdomain policy file required by EVERY web application?

1) If a web application does NOT use any Flash content, does it require crossdomain / clientacess policy file ? 2) If a web application does not host crossdomain / clientaccess policy file, is it ...
4 votes
3 answers
3k views

3rd party API access: Is OAuth really required?

Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, ...
2 votes
1 answer
213 views

OpenID Connect: API access using same identity provider

Does OpenID Connect support the following SSO-like scheme: Both website S and some meta-website M support login using OpenID Connect, e.g. with a Google account. Is it possible for M to access a user'...
4 votes
2 answers
492 views

Is the following authentication solution safe or am I missing something?

Context: I have two web servers ServerA (LAMP stack) and ServerB (ASP.NET stack). I think the technology (hopefully) does not matter. Both servers require authentication and supposedly doing their ...