Questions tagged [crossdomain]
The crossdomain tag has no usage guidance.
60
questions
1
vote
1
answer
4k
views
Best way to deal with cross-domain authentication in intranet
Firstly, I'm not sure if this is valid board to ask this question - maybe it should be asked on StackOverflow?
Overview on use-case, what we trying to achieve:
Two servers, on two different domains; ...
- 121
4
votes
1
answer
4k
views
Crossdomain.xml vulnerabilities
<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
<site-control permitted-cross-domain-policies="master-only"/>
</cross-domain-policy>
I would like to ask ...
- 1,590
23
votes
2
answers
57k
views
Can a website make an HTTP request to "localhost"? How does it get around the cross-domain policy?
I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability.
The website in question has a "patch me" button, and if you have a password-less Redis ...
- 413
3
votes
2
answers
1k
views
Will a crossdomain.xml file reduce a potential security risk?
I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
- 6,661
4
votes
0
answers
131
views
Cross Origin Resource Sharing question
I have some mockup html/javascript on my desktop, I made an ajax GET call to:
http://www.bungie.net/platform/Destiny/TigerPSN/Account/4611686018429149347/Character/2305843009215132906/Activities/
...
2
votes
1
answer
11k
views
Cross Domain Javascript security [duplicate]
I used a web vulnerability scanner to scan my web site. It indicates several links with "Cross domain Java script source file inclusion."
May I know how would an attacker exploit this type of ...
- 715
5
votes
3
answers
7k
views
External cross domain include script
One of my web application underwent a vulnerability assessment recently, and one of the findings is about cross domain include script. Our web app uses addthis_widget.js from AddThis to bookmark ...
- 715
1
vote
2
answers
356
views
HTTP/S <-> HTTP/S cross-site requests: what do third-party websites know about where their objects are being referenced from?
There are four general cross-site request combinations security-wise, and I want to know whether ysite.com, in each case, knows that the reason I downloaded one of its resources was because I was ...
user21377
1
vote
1
answer
1k
views
Iframe postmessage fraud
I've reviewed some material here and in other sites relating to secure usage of Window.postMessage. There is a bunch of material regarding best practices but one of my questions remained unanswered.
...
- 551
53
votes
6
answers
23k
views
Does injecting querystring values directly into HTML pose a security risk?
Someone reported a bug on my site that I don't really consider an issue. My site has an URL akin to this:
www.site.com/ajax/ads.asp?callback=[text injection]
So filetype is application/json, and I ...
- 1,442