I think you're right. If you embed any image you don't have control over or allow users to do that then js embedded in the supposed image could gank your sessi

I think you're right. If you embed any image you don't have control over or allow users to do that then js embedded in the supposed image could gank your session cookies. Avoidance strategies(?): 1) Copy embedded images to your server, validate, and substitute link on your server for off-site link 2) To avoid cross-site scripting hacks anyway, store ip address along with session key on your server and validate that with every request. (Won't protect against attackers on the same side of a NAT though.) This would also affect images embedded in emails, assuming user is using Outlook or IE to read mails?