4 ms·

I'm surprised no one mentioned the obvious security issues arising from the use of CDNs, especially when used to deliver JavaScript source code. When you serve

by nadaviv 11y ago

I'm surprised no one mentioned the obvious security issues arising from the use of CDNs, especially when used to deliver JavaScript source code. When you serve your JavaScript over a CDN rather than directly from your server, the CDN has access to pretty much everything your users have access to - the CDN can read cookies and local tokens, make actions on behalf of users (such as updating the profile, messaging users, deleting content, making payments), read out financial/sensitive information, and more. A permanent and impossible to fix XSS attack vector that can be abused by your CDN, or anyone who hacks to your CDN. This, in addition to security issues caused when the CDN proxies requests to your main hostname and not only to your static files (requiring you to surrender your SSL keys to them). While working on Bitrated, a Bitcoin service that deals with users' private keys and funds on the client-side, this stood out as a very serious issue. We opted to not serve any content from 3rd-party providers, at all (including Analytic services, which suffer from the very same issue), and configured a strict Content-Security-Policy that forbids anything other than hostnames controlled directly by us over SSL. Edit: I'm aware of SRI, but it is brand new and not yet supported by the majority of browsers in use, so its not really a realistic solution just yet.

throwaway7767 11y ago
This article is quoting "CDN experts", in other words people with a financial interest in CDNs. It's not in their interests to point out how the proliferation of CDNs results in centralisation of the internet and hence makes them tempting targets. Or how it gives a few companies the power to effectively shut out certain groups of users from large parts of the web (like CloudFlare did to Tor users a while back). It's really disappointing to me to see the CDNs swallow the web whole. But at the same time I understand it, it's not really possible to protect against DDoS attacks for example without that kind of scale.
ryan-c 11y ago
What you can do with some CDNs is have a self-served loader that pulls the files from the CDN using XHR (requiring CORS headers...), verifies the content hash, then injects it into the page if it looks good. I have a PoC on github https://github.com/ryancdotorg/verifyjs https://github.com/ryancdotorg/verifyjs - same sort of thing could be modified to support signed files rather than hashed, which SRI can't do.
- mxpxrocks10 11y ago
  that's a pretty cool POC Ryan. Do you know @jdorfman? You guys should hook up
  - ryan-c 11y ago
    I do not - I mainly do arcane infosec work and only in the past two years or so (I've gotten better with javascript in that time) have I been doing non-trivial client side stuff. Consequently, most of my professional contacts are in infosec.
    - mxpxrocks10 11y ago
      cool. I asked him to drop you a line

by nadaviv 11y ago

throwaway7767 11y ago

This article is quoting "CDN experts", in other words people with a financial interest in CDNs. It's not in their interests to point out how the proliferation of CDNs results in centralisation of the internet and hence makes them tempting targets. Or how it gives a few companies the power to effectively shut out certain groups of users from large parts of the web (like CloudFlare did to Tor users a while back). It's really disappointing to me to see the CDNs swallow the web whole. But at the same time I understand it, it's not really possible to protect against DDoS attacks for example without that kind of scale.

ryan-c 11y ago

What you can do with some CDNs is have a self-served loader that pulls the files from the CDN using XHR (requiring CORS headers...), verifies the content hash, then injects it into the page if it looks good. I have a PoC on github https://github.com/ryancdotorg/verifyjs https://github.com/ryancdotorg/verifyjs - same sort of thing could be modified to support signed files rather than hashed, which SRI can't do.

mxpxrocks10 11y ago
that's a pretty cool POC Ryan. Do you know @jdorfman? You guys should hook up
- ryan-c 11y ago
  I do not - I mainly do arcane infosec work and only in the past two years or so (I've gotten better with javascript in that time) have I been doing non-trivial client side stuff. Consequently, most of my professional contacts are in infosec.
  - mxpxrocks10 11y ago
    cool. I asked him to drop you a line