Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

7
  • I've updated the question to clarify that Victor does not need to check Eve's site at run time, he can simply include them in his JS. Commented Sep 10, 2013 at 4:51
  • Okay, it seems as if CORS does not allow for read-only access. Indeed, none of the browser security mechanisms include read-only mechanisms. The only parts that need to persist across sessions is domain<->IP mappings in localStorage. What if the read/write access was set by script that was sandboxed from all parties? The parent frame only needs to rewrite .alt -> eve.tld and manage the URL states. Commented Sep 10, 2013 at 5:44
  • When you said "Victor does not need to check Eve's site at run time", he has to to verify it has no malicious JS injected. Also what do you mean exactly with "What if the read/write access was set by script that was sandboxed from all parties?" You really cant have read access to a parent or child frame, you can pretty much only use postMessage to communicate ( or change the URL #hashthing ) Commented Sep 10, 2013 at 14:13
  • I just didn't understand why you were verifying the site contents using a proxy. As far as the read/write access, if a user made it to the correct IP, then Victor really doesn't care what DNS information Alice has. Thus he only needs to verify the URL rewriting JS and we can prevent Victor from tampering with the DNS information. Commented Sep 10, 2013 at 16:16
  • You need a proxy when you cannot CORS directly from iframe victor.alt to victor.eve.tld, that's what i posted in the answer. ( The proxy is more or less our read access to the top window, because we cannot read the iframe nor can we request victor.eve.tld/ which would be the other option ) Commented Sep 10, 2013 at 20:50