CODEWITHSUNDEEP
javascripthtmlsecurityembed
Victor L
Victor L

Reputation: 10240

How to prevent access to web app that is intended for embedding?

I have a web app http://embed.myapp.com that is intended to be embedded on a few whitelisted sites. The frame access is controlled with X-Frame-Options ALLOW-FROM

However, I do not want users to access it by putting in the above link directly in the web browser.

What is the best way to block plain (non-embedded) access?

I can determine whether the site is embedded with javascript, but by that point a session is already created and certain sensitive information such as CSRF tokens can be seen.

Upvotes: 0

Views: 50

Answers (1)

leonm
leonm

Reputation: 6484

You may not quite get an absolutely foolproof way of stopping users from looking at the content directly.

A simple way to catch most cases would be to look at the referer header ( http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html section 14.36) on the server side and only serve the content when it is referred from the correct pages.

Upvotes: 1

Related Questions