Questions tagged [crossdomain]
The crossdomain tag has no usage guidance.
60
questions
83
votes
6
answers
39k
views
How does CORS prevent XSS?
I recently learned about CORS and got the impression that its purpose is to prevent XSS. With CORS, the browser blocks requests to different domains, unless particular headers are in place.
But if a ...
- 1,310
66
votes
6
answers
45k
views
Is CORS helping in anyway against Cross-Site Forgery?
I've been reading in the last couple of days about CORS and in a lot of places it's mentioned as it is a "Security" feature to help the world from cross domain forgery.
I still don't see the benefit ...
- 769
53
votes
6
answers
23k
views
Does injecting querystring values directly into HTML pose a security risk?
Someone reported a bug on my site that I don't really consider an issue. My site has an URL akin to this:
www.site.com/ajax/ads.asp?callback=[text injection]
So filetype is application/json, and I ...
- 1,442
23
votes
2
answers
57k
views
Can a website make an HTTP request to "localhost"? How does it get around the cross-domain policy?
I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability.
The website in question has a "patch me" button, and if you have a password-less Redis ...
- 413
15
votes
2
answers
4k
views
How does medium.com know my google account?
I went to an article on medium.com earlier today, and instead of the annoying full screen popup they usually show to returning visitors, I saw this in the upper right corner:
Right there on the ...
- 261
12
votes
2
answers
13k
views
How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?
I need to implement an SSO solution with the following requirements:
Cross-domain: Let's assume I have a.com, b.com and sso.com. If I become logged in through a.com, I shouldn't need to login when I ...
- 373
10
votes
1
answer
11k
views
How to implement CSRF protection with a cross origin request (CORS)
tl;dr the Cookie-to-header-token method can't work due to the CSRF token cookie not being readable by the client in any way. Is sending the token in a header, and having the client save it in a cookie ...
- 891
9
votes
2
answers
5k
views
How did the Facebook Originull vulnerablity of Access-Control-Allow-Origin: null allow cross-origin access?
Recently, a vulnerability in Facebook's messenger app which allowed attacks to access a users private messages via cross-origin AJAX was patched and disclosed.
Simple Bug allows Hackers to Read all ...
- 8,834
9
votes
1
answer
8k
views
Security about window.opener and iframes
I have 3 domains : domainA domainB domainC
If I set target="_blank" on domainA with a link to domainC, domainC can access a bunch of property of domainA. That's why I use target="_blank" rel="...
- 2,904
7
votes
4
answers
9k
views
How to securely set a cookie on another subdomain?
I have a microservice app. hub.example.com handles authentication. When a users logs in, I need to set a cookie on learn.example.com What is a secure way to set this? I'm aware of a few approaches:
...
- 33.4k
7
votes
2
answers
2k
views
Why are cookies sent with HTML page's cross domain requests but not with JS's XHR?
When we write a HTML page with form tag and an action attribute and a submit button. As soon as we click on submit a request is sent (with cookies) to the URL which was the value of action attribute.
...
- 71
6
votes
2
answers
6k
views
Cross domain iframe security
How exploitable is a site listening to browser messages from anyone?
I am working on a site where I have found some iframe issues. The case is that site A has an iframe of site B, and site A listens ...
- 61
6
votes
1
answer
330
views
Why was the Same-origin policy originally introduced (before XMLHttpRequest)?
As I understand it, the Same-origin policy (SOP) basically prevents a script in a web page from obtaining or sending information from/to a different domain.
I understand that this is important to ...
- 1,643
5
votes
3
answers
7k
views
External cross domain include script
One of my web application underwent a vulnerability assessment recently, and one of the findings is about cross domain include script. Our web app uses addthis_widget.js from AddThis to bookmark ...
- 715
5
votes
1
answer
4k
views
Chrome extension: Cross origin request
Can chrome extensions make cross-origin requests by injecting a javascript into the main page? If so, isn't it a security vulnerability?
Google Chrome Content Scripts
Cross Origin Requests
- 193
5
votes
1
answer
5k
views
How to check for cross-domain referrer leakage?
I am learning pen testing on web applications. I found the vulnerability cross-domain referrer leakage very interesting. Can anybody please tell me how to check for this vulnerability on any web ...
- 51
4
votes
3
answers
3k
views
3rd party API access: Is OAuth really required?
Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, ...
- 255
4
votes
1
answer
4k
views
Crossdomain.xml vulnerabilities
<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
<site-control permitted-cross-domain-policies="master-only"/>
</cross-domain-policy>
I would like to ask ...
- 1,590
4
votes
1
answer
2k
views
What are the security implications of enabling CORS for images?
The company I work for runs a user profile photo server. I would like to fetch, visually modify (add a blur, some effects, etc.), and display those images in <canvas>. The problem is that the ...
- 189
4
votes
2
answers
472
views
Is the following authentication solution safe or am I missing something?
Context:
I have two web servers ServerA (LAMP stack) and ServerB (ASP.NET stack). I think the technology (hopefully) does not matter. Both servers require authentication and supposedly doing their ...
- 220
4
votes
0
answers
131
views
Cross Origin Resource Sharing question
I have some mockup html/javascript on my desktop, I made an ajax GET call to:
http://www.bungie.net/platform/Destiny/TigerPSN/Account/4611686018429149347/Character/2305843009215132906/Activities/
...
3
votes
1
answer
980
views
Is xhr.withCredentials making POST endpoints vulnerable to CSRF?
From what I've seen, someone can add the following code to a malicious site (lets say: http://sth.malicioussite.com) and be able to perform ajax post requests to a 3rd party site, along with any ...
- 191
3
votes
2
answers
582
views
Automatic's Jetpack login auth....Why isn't this a security flaw?
I’m framing this question vis-a-vi Automatic and Jetpack, but I think it’s about something I don’t personally understand that is happening in a WordPress context, so I’m posting here. It’s not about ...
- 139
3
votes
1
answer
3k
views
Is there any way to access the contents of a cross domain iframe
I found that a subdomain of a site leaks all cookies of the site due to improper error handling. Now, I found that this site does not have X-Frame Options Header in it. So, I put this subdomain in the ...
- 133
3
votes
1
answer
496
views
Access control allow origin browser protection efficiency
I was building a website as an experiment, and tried using few ajax requests to different sites. On some sites I will get an error:
XMLHttpRequest cannot load http://example.com/path No
'Access-...
- 31
3
votes
1
answer
3k
views
Is a Kerberos ticket valid with only one-way external trust between domains?
The situation is that I have two domains (Domain A and Domain B) that live on separate networks. I need to allow users in B to be authenticated with integrated windows authentication (IWA) when they ...
- 33
3
votes
2
answers
1k
views
Is crossdomain policy file required by EVERY web application?
1) If a web application does NOT use any Flash content, does it require crossdomain / clientacess policy file ?
2) If a web application does not host crossdomain / clientaccess policy file, is it ...
3
votes
2
answers
1k
views
Will a crossdomain.xml file reduce a potential security risk?
I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
- 6,661
3
votes
1
answer
808
views
SubtleCrypto with non-extractable keys stored in IndexedDB - Cross Origin Usage
In a browser I want to use SublteCrypto (https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto) to create a key pair and store it locally in the IndexedDB (https://developer.mozilla.org/en-US/...
- 31
3
votes
1
answer
594
views
Single Page Application with REST API backend based on XML, queried by dynamic XPath
A web application I'm developing will be a Single Page Application (SPA) that will interact with a REST API backend, through jQuery.ajax() calls.
The SPA and API will both be served over an https/TLS ...
- 133
2
votes
1
answer
3k
views
Cross-domain session standardization
I am looking into cross-domain sessions. These are sessions which are shared between two domains like google.com and spotify.com. I'm not looking for information regarding cross-domain sessions ...
- 1,820
2
votes
1
answer
11k
views
Cross Domain Javascript security [duplicate]
I used a web vulnerability scanner to scan my web site. It indicates several links with "Cross domain Java script source file inclusion."
May I know how would an attacker exploit this type of ...
- 715
2
votes
1
answer
42k
views
Accesssing cookies of another domain using Iframes and Javascript
Using Iframe we can embed webpages of another domain provided the X-Frame-Options isn't set to SAMEORIGIN. This also loads the cookie inside the iframe.
Now, one can access this cookie if it's in the ...
- 79
2
votes
2
answers
2k
views
How to access CSRF token in fronted when API is on different domain?
I am building a website with a separate Javascript frontend and a Django backend. My backend uses CSRF protection.
Now the problem is that the CSRF token is being set on the client side as a cookie on ...
- 23
2
votes
1
answer
1k
views
Is it secure to use window.origin with postMessage?
When using postMessage it's important to define a targetOrigin to ensure we don't leak data to other sites.
It's equally important to check the origin when receiving a message to prevent other sites ...
- 121
2
votes
1
answer
194
views
OpenID Connect: API access using same identity provider
Does OpenID Connect support the following SSO-like scheme:
Both website S and some meta-website M support login using OpenID Connect, e.g. with a Google account. Is it possible for M to access a user'...
- 255
2
votes
1
answer
197
views
What does COEP do that CSP doesn't already do?
Both Cross-Origin-Embedder-Policy and Content-Security-Policy seem to do pretty similar things: they restrict the document from loading certain types of subresources (e.g. cross-origin subresources). ...
1
vote
1
answer
1k
views
Iframe postmessage fraud
I've reviewed some material here and in other sites relating to secure usage of Window.postMessage. There is a bunch of material regarding best practices but one of my questions remained unanswered.
...
- 551
1
vote
1
answer
866
views
Would the CORS specification consider a missing Content-Type header to imply a "simple header"?
RFC 7231, Section 3.1.1.5 states:
A sender that generates a message containing a payload body SHOULD
generate a Content-Type header field in that message unless the
intended media type of the ...
- 400
1
vote
2
answers
1k
views
Cross-Domain Request is a CSRF Attack? (CORS)
CORS is a HTTP Suite header that “relax” the SOP. One of the CORS misconfigurations is about to reflect without reg exp the “Origin” client header into “ACAO” response header. If it happens with “ACAC:...
- 21
1
vote
1
answer
444
views
What's the purpose of the preflight check on CORS requests?
A fellow developer and I were experiencing a weird issue with our application in the past couple of days. Specifically, he's writing the API and I'm writing the web front end. Since the UI runs from ...
- 281
1
vote
2
answers
209
views
CORS clarification
I need some clarifications about the problems that CORS (Cross-Origin Resource Sharing) can cause.
Let's suppose that site A.COM has enabled CORS, in particular:
Access-Control-Allow-Origin can be ...
- 130
1
vote
1
answer
364
views
what prevents sending "$.post" from one domain to another?
I have one website in chromium tab, and an other website in another tab,
Im executing single post command in the second website - $.post(...); to the first website.
Originaly its not working (getting: ...
- 33
1
vote
1
answer
8k
views
No Preflight Request is made during XHR cross-origin request
I made a XHR cross-origin request from a html file, hosted on a python Simple HTTP Server.
var xhr = new XMLHttpRequest();
xhr.open("GET", "https://www.facebook.com/favicon.ico", true);
xhr....
- 79
1
vote
1
answer
178
views
How did a malicious website managed to serve me the app that is running on my local apache server?
Today I accidentally miss-typed a popular's website domain, which led me to a malicious website. I realized immediately but before I had time to close the tab, I was surprised to be presented with the ...
- 21
1
vote
1
answer
3k
views
security issues related to setting cookie using an <img> tag
Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B.
Site B will return an image response, and in that response a cookie will be set (cookie of Site B's ...
- 113
1
vote
1
answer
425
views
When is CORS applied?
I'm including some RUM (Real User Monitoring) JavaScript on a client's website that beacons back performance info. I was expecting to run into CORS issues but it seems to be working without any ...
- 13
1
vote
3
answers
807
views
How to stop app from fetching data from my website?
I am running a website that contains data that our users can access if they login.
Someone else has created an Android app that lets users access that data as well. They enter their credentials, and ...
- 11
1
vote
1
answer
914
views
Loading a logged in page in an iframe
Suppose www.youtube.com have no X-Frame-Options set.
Imagine I'm already logged in to YouTube. Now from another web page in the same browser I'm loading YouTube in an iframe, will the browser send ...
- 181
1
vote
1
answer
1k
views
Secure crossdomain for rtmp/flash streaming/wowza
I've been a bit lost. I have the following situation:
Flash Player file is on https://sub.example.com/player.swf
crossdomain.xml is on https://sub2.example.com/crossdomain.xml
Streaming is done ...
- 943