Questions tagged [crossdomain]
The crossdomain tag has no usage guidance.
60
questions
0
votes
1
answer
58
views
Is it safe to allow linking to images by URL in user-made posts?
I'm working on an imageboard website that uses the TinyIB bulletin board software.
When editing the settings, I found this line:
define('TINYIB_UPLOADVIAURL', false); // Allow files to be uploaded via ...
- 3
1
vote
1
answer
4k
views
Set cookie inside iFrame domain not seen
I'm trying unsuccessfully to set a cookie in an iframe cross-domain. I've found elsewhere (https://stackoverflow.com/questions/2117248/setting-cookie-in-iframe-different-domain, https://stackoverflow....
- 11
0
votes
0
answers
304
views
Cross-domain login authentication
I am currently working as system integrator for a banking company, that asked me to provide an authentication integration on a third party website on which the company would like to redirect users, ...
- 11
2
votes
1
answer
199
views
What does COEP do that CSP doesn't already do?
Both Cross-Origin-Embedder-Policy and Content-Security-Policy seem to do pretty similar things: they restrict the document from loading certain types of subresources (e.g. cross-origin subresources). ...
2
votes
2
answers
2k
views
How to access CSRF token in fronted when API is on different domain?
I am building a website with a separate Javascript frontend and a Django backend. My backend uses CSRF protection.
Now the problem is that the CSRF token is being set on the client side as a cookie on ...
- 23
0
votes
1
answer
721
views
COOP and COEP: Is there an advantage to enabling COOP / COEP if I don't need to use the sharedArrayBuffer or other features?
COOP: cross origin opener policy
COEP: Cross origin embedder policy
Most of the articles on the web, related to COOP / COEP, point to the fact that by enabling COOP / COEP , your web page can use the ...
- 283
1
vote
0
answers
300
views
I have CSRF protection implemented server side, can I safely use `SameSite=None; Secure; HttpOnly`?
We have a web service where GET is always safe and all unsafe POST requests use single-use CSRF tokens. We have some cases where cross-origin domain would need to pass us POST request with data that ...
3
votes
1
answer
818
views
SubtleCrypto with non-extractable keys stored in IndexedDB - Cross Origin Usage
In a browser I want to use SublteCrypto (https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto) to create a key pair and store it locally in the IndexedDB (https://developer.mozilla.org/en-US/...
- 31
2
votes
1
answer
1k
views
Is it secure to use window.origin with postMessage?
When using postMessage it's important to define a targetOrigin to ensure we don't leak data to other sites.
It's equally important to check the origin when receiving a message to prevent other sites ...
- 121
0
votes
1
answer
210
views
Are there security issues around controlled cross site sharing behind SSO?
Very simply we have a ton of websites at our company behind SSO.
I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
- 118
1
vote
2
answers
1k
views
Cross-Domain Request is a CSRF Attack? (CORS)
CORS is a HTTP Suite header that “relax” the SOP. One of the CORS misconfigurations is about to reflect without reg exp the “Origin” client header into “ACAO” response header. If it happens with “ACAC:...
- 21
7
votes
4
answers
9k
views
How to securely set a cookie on another subdomain?
I have a microservice app. hub.example.com handles authentication. When a users logs in, I need to set a cookie on learn.example.com What is a secure way to set this? I'm aware of a few approaches:
...
- 33.4k
3
votes
1
answer
3k
views
Is there any way to access the contents of a cross domain iframe
I found that a subdomain of a site leaks all cookies of the site due to improper error handling. Now, I found that this site does not have X-Frame Options Header in it. So, I put this subdomain in the ...
- 133
6
votes
1
answer
330
views
Why was the Same-origin policy originally introduced (before XMLHttpRequest)?
As I understand it, the Same-origin policy (SOP) basically prevents a script in a web page from obtaining or sending information from/to a different domain.
I understand that this is important to ...
- 1,643
1
vote
1
answer
178
views
How did a malicious website managed to serve me the app that is running on my local apache server?
Today I accidentally miss-typed a popular's website domain, which led me to a malicious website. I realized immediately but before I had time to close the tab, I was surprised to be presented with the ...
- 21
7
votes
2
answers
2k
views
Why are cookies sent with HTML page's cross domain requests but not with JS's XHR?
When we write a HTML page with form tag and an action attribute and a submit button. As soon as we click on submit a request is sent (with cookies) to the URL which was the value of action attribute.
...
- 71
0
votes
1
answer
228
views
Inconsistent behavior while attempting to exploit a misconfigured flash crossdomain.xml
victim.com - URL of the misconfigured application.
https://victim.com has an overly permissive crossdomain.xml at https://victim.com/crossdomain.xml.
<?xml version="1.0"?>
<!DOCTYPE cross-...
- 3,901
1
vote
1
answer
3k
views
security issues related to setting cookie using an <img> tag
Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B.
Site B will return an image response, and in that response a cookie will be set (cookie of Site B's ...
- 113
1
vote
3
answers
809
views
How to stop app from fetching data from my website?
I am running a website that contains data that our users can access if they login.
Someone else has created an Android app that lets users access that data as well. They enter their credentials, and ...
- 11
1
vote
1
answer
446
views
What's the purpose of the preflight check on CORS requests?
A fellow developer and I were experiencing a weird issue with our application in the past couple of days. Specifically, he's writing the API and I'm writing the web front end. Since the UI runs from ...
- 281
3
votes
1
answer
986
views
Is xhr.withCredentials making POST endpoints vulnerable to CSRF?
From what I've seen, someone can add the following code to a malicious site (lets say: http://sth.malicioussite.com) and be able to perform ajax post requests to a 3rd party site, along with any ...
- 191
10
votes
1
answer
11k
views
How to implement CSRF protection with a cross origin request (CORS)
tl;dr the Cookie-to-header-token method can't work due to the CSRF token cookie not being readable by the client in any way. Is sending the token in a header, and having the client save it in a cookie ...
- 891
15
votes
2
answers
4k
views
How does medium.com know my google account?
I went to an article on medium.com earlier today, and instead of the annoying full screen popup they usually show to returning visitors, I saw this in the upper right corner:
Right there on the ...
- 261
1
vote
2
answers
209
views
CORS clarification
I need some clarifications about the problems that CORS (Cross-Origin Resource Sharing) can cause.
Let's suppose that site A.COM has enabled CORS, in particular:
Access-Control-Allow-Origin can be ...
- 130
1
vote
1
answer
917
views
Loading a logged in page in an iframe
Suppose www.youtube.com have no X-Frame-Options set.
Imagine I'm already logged in to YouTube. Now from another web page in the same browser I'm loading YouTube in an iframe, will the browser send ...
- 181
12
votes
2
answers
13k
views
How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?
I need to implement an SSO solution with the following requirements:
Cross-domain: Let's assume I have a.com, b.com and sso.com. If I become logged in through a.com, I shouldn't need to login when I ...
- 373
3
votes
2
answers
582
views
Automatic's Jetpack login auth....Why isn't this a security flaw?
I’m framing this question vis-a-vi Automatic and Jetpack, but I think it’s about something I don’t personally understand that is happening in a WordPress context, so I’m posting here. It’s not about ...
- 139
1
vote
1
answer
364
views
what prevents sending "$.post" from one domain to another?
I have one website in chromium tab, and an other website in another tab,
Im executing single post command in the second website - $.post(...); to the first website.
Originaly its not working (getting: ...
- 33
0
votes
2
answers
506
views
Setting Access-Control-Allow-Origin: * when session identifiers are injected in the HTTP headers
Is it considered as secure for an application to set a header access-control-allow-origin: * if during the normal usage of the application, the client credentials are injected in the headers by the JS ...
- 217
1
vote
1
answer
8k
views
No Preflight Request is made during XHR cross-origin request
I made a XHR cross-origin request from a html file, hosted on a python Simple HTTP Server.
var xhr = new XMLHttpRequest();
xhr.open("GET", "https://www.facebook.com/favicon.ico", true);
xhr....
- 79
5
votes
1
answer
4k
views
Chrome extension: Cross origin request
Can chrome extensions make cross-origin requests by injecting a javascript into the main page? If so, isn't it a security vulnerability?
Google Chrome Content Scripts
Cross Origin Requests
- 193
9
votes
2
answers
5k
views
How did the Facebook Originull vulnerablity of Access-Control-Allow-Origin: null allow cross-origin access?
Recently, a vulnerability in Facebook's messenger app which allowed attacks to access a users private messages via cross-origin AJAX was patched and disclosed.
Simple Bug allows Hackers to Read all ...
- 8,834
9
votes
1
answer
8k
views
Security about window.opener and iframes
I have 3 domains : domainA domainB domainC
If I set target="_blank" on domainA with a link to domainC, domainC can access a bunch of property of domainA. That's why I use target="_blank" rel="...
- 2,914
6
votes
2
answers
6k
views
Cross domain iframe security
How exploitable is a site listening to browser messages from anyone?
I am working on a site where I have found some iframe issues. The case is that site A has an iframe of site B, and site A listens ...
- 61
5
votes
1
answer
5k
views
How to check for cross-domain referrer leakage?
I am learning pen testing on web applications. I found the vulnerability cross-domain referrer leakage very interesting. Can anybody please tell me how to check for this vulnerability on any web ...
- 51
3
votes
1
answer
496
views
Access control allow origin browser protection efficiency
I was building a website as an experiment, and tried using few ajax requests to different sites. On some sites I will get an error:
XMLHttpRequest cannot load http://example.com/path No
'Access-...
- 31
3
votes
1
answer
3k
views
Is a Kerberos ticket valid with only one-way external trust between domains?
The situation is that I have two domains (Domain A and Domain B) that live on separate networks. I need to allow users in B to be authenticated with integrated windows authentication (IWA) when they ...
- 33
1
vote
1
answer
1k
views
Secure crossdomain for rtmp/flash streaming/wowza
I've been a bit lost. I have the following situation:
Flash Player file is on https://sub.example.com/player.swf
crossdomain.xml is on https://sub2.example.com/crossdomain.xml
Streaming is done ...
- 943
4
votes
1
answer
2k
views
What are the security implications of enabling CORS for images?
The company I work for runs a user profile photo server. I would like to fetch, visually modify (add a blur, some effects, etc.), and display those images in <canvas>. The problem is that the ...
- 189
2
votes
1
answer
3k
views
Cross-domain session standardization
I am looking into cross-domain sessions. These are sessions which are shared between two domains like google.com and spotify.com. I'm not looking for information regarding cross-domain sessions ...
- 1,820
3
votes
2
answers
1k
views
Is crossdomain policy file required by EVERY web application?
1) If a web application does NOT use any Flash content, does it require crossdomain / clientacess policy file ?
2) If a web application does not host crossdomain / clientaccess policy file, is it ...
3
votes
1
answer
594
views
Single Page Application with REST API backend based on XML, queried by dynamic XPath
A web application I'm developing will be a Single Page Application (SPA) that will interact with a REST API backend, through jQuery.ajax() calls.
The SPA and API will both be served over an https/TLS ...
- 133
2
votes
1
answer
194
views
OpenID Connect: API access using same identity provider
Does OpenID Connect support the following SSO-like scheme:
Both website S and some meta-website M support login using OpenID Connect, e.g. with a Google account. Is it possible for M to access a user'...
- 255
4
votes
3
answers
3k
views
3rd party API access: Is OAuth really required?
Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, ...
- 255
4
votes
2
answers
472
views
Is the following authentication solution safe or am I missing something?
Context:
I have two web servers ServerA (LAMP stack) and ServerB (ASP.NET stack). I think the technology (hopefully) does not matter. Both servers require authentication and supposedly doing their ...
- 220
1
vote
1
answer
870
views
Would the CORS specification consider a missing Content-Type header to imply a "simple header"?
RFC 7231, Section 3.1.1.5 states:
A sender that generates a message containing a payload body SHOULD
generate a Content-Type header field in that message unless the
intended media type of the ...
- 400
2
votes
1
answer
42k
views
Accesssing cookies of another domain using Iframes and Javascript
Using Iframe we can embed webpages of another domain provided the X-Frame-Options isn't set to SAMEORIGIN. This also loads the cookie inside the iframe.
Now, one can access this cookie if it's in the ...
- 79
83
votes
6
answers
40k
views
How does CORS prevent XSS?
I recently learned about CORS and got the impression that its purpose is to prevent XSS. With CORS, the browser blocks requests to different domains, unless particular headers are in place.
But if a ...
- 1,310
1
vote
1
answer
425
views
When is CORS applied?
I'm including some RUM (Real User Monitoring) JavaScript on a client's website that beacons back performance info. I was expecting to run into CORS issues but it seems to be working without any ...
- 13
66
votes
6
answers
45k
views
Is CORS helping in anyway against Cross-Site Forgery?
I've been reading in the last couple of days about CORS and in a lot of places it's mentioned as it is a "Security" feature to help the world from cross domain forgery.
I still don't see the benefit ...
- 769