Posted by: Dakusan
« on: October 03, 2015, 03:31:57 pm »Original post for Cross site scripting solutions can be found at https://www.castledragmire.com/Posts/Cross_site_scripting_solutions.
Originally posted on: 10/03/15
Originally posted on: 10/03/15
So I was recently hired to set up a go-between system that would allow two independent websites to directly communicate and transfer/copy data between each other via a web browser. This is obviously normally not possible due to cross-site browser security settings (XSS), so I gave the client 2 possible solutions. Both of these solutions are written with the assumption that there is a go-between intermediary iframe/window, on a domain that they control, between the 2 independent site iframes/window. This would also work fine for one site you control against a site you do not control.
- Tell the browser to ignore this security requirement:
- For example, if you add to the chrome command line arguments “--disable-web-security”, cross-site security checks will be removed. However, chrome will prominently display on the very first tab (which can be closed) at the top of the browser “You are using an unsupported command-line flag: —disable-web-security. Stability and security will suffer”. This can be scary to the user, and could also allow security breaches if the user utilizes that browser [session] for anything except the application page.
- The more appropriate way to do it, which requires a bit of work on the administrative end, is having all 3 sites pretend to run off of the same domain. To do this:
- You must have a domain that you control, which we will call UnifyingDomain.com (This top level domain can contain subdomains)
- The 2 sites that YOU control would need a JavaScript line of “document.domain='UnifyingDomain.com';” somewhere in them. These 2 sites must also be run off of a subdomain of UnifyingDomain.com, (which can also be done through apache redirect directives).
- The site that you do not control would need to be forwarded through your UnifyingDomain.com (not a subdomain) via an apache permanent redirect.
- This may not work, if their site programmer is dumb and does not use proper relative links for everything (absolute links are the devil :-) ). If this is the case:
- You can use a [http] proxy to pull in their site through your domain (in which case, if you wanted, you could inject a “domain=”)
- You can use the domain that you do not control as the top level UnifyingDomain.com, and add rules into your computer’s hostname files to redirect its subdomains to your IPs.
- This may not work, if their site programmer is dumb and does not use proper relative links for everything (absolute links are the devil :-) ). If this is the case:
This project is why I ended up making my HTTP Forwarders client in go (coming soon).
