3 ms·
I'm not following this. In the given example you would configure a proxy to route /api requests to your API cluster. How would an attacker inject a different
by dasil003 8y ago
I'm not following this. In the given example you would configure a proxy to route /api requests to your API cluster. How would an attacker inject a different backend origin?
- tptacek 8y agoThey wouldn't, but if you proxy arbitrary requests for UnicornGifs.sexy through your CatSharing.com backend, and UnicornGifs.sexy gets owned up (or even just mischievous), it can now generate malicious content in the same origin as CatSharing.com --- the browser can't differentiate which is which. And that forged CatSharing content will be valid in any page on CatSharing.com, not just the specific pages that include it. The point is that when you serverside-proxy requests to third parties, you're implicitly trusting the third party to control the DOM for any app in your domain.
- dasil003 8y agoOh right, I missed the last sentence where OP suggested proxying to third parties.
- krallja 8y agoHow is that different from the unproxied scenario? If unicorngifs.sexy gets pwned, your users get pwned, whether or not there’s a proxy in the middle.
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- wolf550e 8y agoIf you load javascript from there - yes, but if you iframe to there - no. You can design a solution that uses cross-origin browser protection to protect your users from getting owned in case a partner is compromised.