Questions tagged [crossdomain]
The crossdomain tag has no summary.
61 questions
1 vote
1 answer
186 views
JavaScript Control Over New Tab and SOP Behavior
I’d like to ask for some advice regarding controlling a newly opened browser tab using JavaScript. Here’s the situation: I have my own website hosted at my.site.com, which includes a link to a ...
- 11
0 votes
1 answer
145 views
Is it safe to allow linking to images by URL in user-made posts?
I'm working on an imageboard website that uses the TinyIB bulletin board software. When editing the settings, I found this line: define('TINYIB_UPLOADVIAURL', false); // Allow files to be uploaded via ...
- 103
3 votes
2 answers
15k views
Set cookie inside iFrame domain not seen
I'm trying unsuccessfully to set a cookie in an iframe cross-domain. I've found elsewhere (https://stackoverflow.com/questions/2117248/setting-cookie-in-iframe-different-domain, https://stackoverflow....
- 31
0 votes
0 answers
508 views
Cross-domain login authentication
I am currently working as system integrator for a banking company, that asked me to provide an authentication integration on a third party website on which the company would like to redirect users, ...
- 31
4 votes
1 answer
622 views
What does COEP do that CSP doesn't already do?
Both Cross-Origin-Embedder-Policy and Content-Security-Policy seem to do pretty similar things: they restrict the document from loading certain types of subresources (e.g. cross-origin subresources). ...
2 votes
2 answers
3k views
How to access CSRF token in fronted when API is on different domain?
I am building a website with a separate Javascript frontend and a Django backend. My backend uses CSRF protection. Now the problem is that the CSRF token is being set on the client side as a cookie on ...
- 23
0 votes
1 answer
1k views
COOP and COEP: Is there an advantage to enabling COOP / COEP if I don't need to use the sharedArrayBuffer or other features?
COOP: cross origin opener policy COEP: Cross origin embedder policy Most of the articles on the web, related to COOP / COEP, point to the fact that by enabling COOP / COEP , your web page can use the ...
- 313
1 vote
0 answers
417 views
I have CSRF protection implemented server side, can I safely use `SameSite=None; Secure; HttpOnly`?
We have a web service where GET is always safe and all unsafe POST requests use single-use CSRF tokens. We have some cases where cross-origin domain would need to pass us POST request with data that ...
3 votes
1 answer
2k views
SubtleCrypto with non-extractable keys stored in IndexedDB - Cross Origin Usage
In a browser I want to use SublteCrypto (https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto) to create a key pair and store it locally in the IndexedDB (https://developer.mozilla.org/en-US/...
- 31
2 votes
1 answer
2k views
Is it secure to use window.origin with postMessage?
When using postMessage it's important to define a targetOrigin to ensure we don't leak data to other sites. It's equally important to check the origin when receiving a message to prevent other sites ...
- 121
0 votes
1 answer
347 views
Are there security issues around controlled cross site sharing behind SSO?
Very simply we have a ton of websites at our company behind SSO. I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
- 118
1 vote
2 answers
1k views
Cross-Domain Request is a CSRF Attack? (CORS)
CORS is a HTTP Suite header that “relax” the SOP. One of the CORS misconfigurations is about to reflect without reg exp the “Origin” client header into “ACAO” response header. If it happens with “ACAC:...
- 21
7 votes
4 answers
13k views
How to securely set a cookie on another subdomain?
I have a microservice app. hub.example.com handles authentication. When a users logs in, I need to set a cookie on learn.example.com What is a secure way to set this? I'm aware of a few approaches: ...
- 35k
3 votes
1 answer
4k views
Is there any way to access the contents of a cross domain iframe
I found that a subdomain of a site leaks all cookies of the site due to improper error handling. Now, I found that this site does not have X-Frame Options Header in it. So, I put this subdomain in the ...
- 133
6 votes
1 answer
448 views
Why was the Same-origin policy originally introduced (before XMLHttpRequest)?
As I understand it, the Same-origin policy (SOP) basically prevents a script in a web page from obtaining or sending information from/to a different domain. I understand that this is important to ...
- 2,029