4 ms·
So suppose they go and fetch these malicious ads and forward them to you. Now you get that malware directly from the first party. The malware has all the same
by clarry 9y ago
So suppose they go and fetch these malicious ads and forward them to you. Now you get that malware directly from the first party. The malware has all the same-origin access as the first-party application, and you can't trivially block it with things like uMatrix.
That's what I call server deciding for the user. And now you're in real trouble with security.
- Pxtl 9y agoYes, but then the malware can also compromise the server, since it now has js access to all the users and can Masquerade as them when they see the ad - even as admins. Keys to the kingdom. This is a feature, not a bug - it means the user and the server are now in the same boat, and the server will have some friggin diligence about whose code they run. Also, means the server has to pay for the damned bandwidth.
- NMDaniel 9y agoThat's not how it works, the server wouldn't execute JS that is meant for a browser client, it would just serve it like any other static file. What you're suggesting will actually hamper security, because scripts served from your domain have less limitations(see https://en.wikipedia.org/wiki/Same-origin_policy https://en.wikipedia.org/wiki/Same-origin_policy , https://en.wikipedia.org/wiki/Content_Security_Policy https://en.wikipedia.org/wiki/Content_Security_Policy and other mechanisms)
- leeoniya 9y agothe implication of same-origin would affect all requests made from the client. you can serve malicious js from the server all day long but it would be restricted to only talking back to that same server.