Questions tagged [crossdomain]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer

Best way to deal with cross-domain authentication in intranet

Firstly, I'm not sure if this is valid board to ask this question - maybe it should be asked on StackOverflow? Overview on use-case, what we trying to achieve: Two servers, on two different domains; ...
ppatalong's user avatar
  • 121
4 votes
1 answer

Crossdomain.xml vulnerabilities

<cross-domain-policy> <allow-access-from domain="*" secure="false"/> <site-control permitted-cross-domain-policies="master-only"/> </cross-domain-policy> I would like to ask ...
Michal Koczwara's user avatar
23 votes
2 answers

Can a website make an HTTP request to "localhost"? How does it get around the cross-domain policy?

I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability. The website in question has a "patch me" button, and if you have a password-less Redis ...
Daniel Magliola's user avatar
3 votes
2 answers

Will a crossdomain.xml file reduce a potential security risk?

I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
Bob Ortiz's user avatar
  • 6,661
4 votes
0 answers

Cross Origin Resource Sharing question

I have some mockup html/javascript on my desktop, I made an ajax GET call to: ...
Robert Fralin's user avatar
2 votes
1 answer

Cross Domain Javascript security [duplicate]

I used a web vulnerability scanner to scan my web site. It indicates several links with "Cross domain Java script source file inclusion." May I know how would an attacker exploit this type of ...
dorothy's user avatar
  • 715
5 votes
3 answers

External cross domain include script

One of my web application underwent a vulnerability assessment recently, and one of the findings is about cross domain include script. Our web app uses addthis_widget.js from AddThis to bookmark ...
dorothy's user avatar
  • 715
1 vote
2 answers

HTTP/S <-> HTTP/S cross-site requests: what do third-party websites know about where their objects are being referenced from?

There are four general cross-site request combinations security-wise, and I want to know whether, in each case, knows that the reason I downloaded one of its resources was because I was ...
user avatar
1 vote
1 answer

Iframe postmessage fraud

I've reviewed some material here and in other sites relating to secure usage of Window.postMessage. There is a bunch of material regarding best practices but one of my questions remained unanswered. ...
user3074662's user avatar
53 votes
6 answers

Does injecting querystring values directly into HTML pose a security risk?

Someone reported a bug on my site that I don't really consider an issue. My site has an URL akin to this:[text injection] So filetype is application/json, and I ...
Daniel's user avatar
  • 1,442