CODEWITHSUNDEEP
javascriptruby-on-railssecurityformsiframe
anxiety
anxiety

Reputation: 1709

Passing form params through iframe with javascript safe?

Background: I have written a bookmarklet (JavaScript) that appends an iframe to the current page you are viewing. This iframe's src attribute is pointing to a form back on my (rails) application. I need to pass a key into the form (from the bookmarklet) by either modifying one of the values of the input fields or by passing the value as a parameter at the end of the url calling the form action.

I don't really see a way how to do the former, and the latter seems like a security catastrophe waiting to happen. I was wondering what the best practice would be here?

Upvotes: 0

Views: 1891

Answers (3)

Mike Samuel
Mike Samuel

Reputation: 120556

A number of schemes pass secrets in the fragment portion of the URL and then, as then, early in the page load, store it and set the fragment to blank. I think webkeys do this.

On the webkeys page, see specifically

Putting the unguessable permission key in the fragment segment produces an https URL that looks like: https://www.example.com/app/#mhbqcmmva5ja3.

Upvotes: 0

harto
harto

Reputation: 90503

Appending a query string parameter to the URL seems reasonable, but you're correct - there are security implications. The value will appear in the user's browsing history and it'll be visible over unencrypted HTTP (but not HTTPS).

There's another Javascript-based way to do this that's not yet widely supported, but is worth considering - window.postMessage. It allows pages at designated domains to send and receive messages using a familiar event-based model. See https://developer.mozilla.org/en/DOM/window.postMessage.

Upvotes: 2

Niet the Dark Absol
Niet the Dark Absol

Reputation: 324780

This sounds fairly similar to the AJAX framework I made using iFrames. The easiest way is to have your bookmarklet build up a query string and put that on the iFrame's src. If you need to change anything, you should be able to set the iFrame's src to "#param=value" and have the page in the iFrame register the onhashchange event to deal with it (this would be how you could go about the former)
So your code could either be: 

var iframe = document.createElement('iframe');
iframe.src = "http://example.com/mypage?param1=value1&param2=value2";
document.body.appendChild(iframe);

and/or: 

iframe.src = "#param1=value1";
// This in the iframe:
document.onhashchange = function() {
    // parse location.hash and process form
}

Upvotes: 1

Related Questions