CODEWITHSUNDEEP
javascriptcross-domainsecurity
r0u1i
r0u1i

Reputation: 3566

What's the security risk of having javascript access an external image?

Using javascript one cannot convert an image (hosted on a different domain than the one the javascript comes from) into a canvas.

What's the security risk with that? It can't just be to avoid phishing, right?

Upvotes: 4

Views: 207

Answers (2)

bjornd
bjornd

Reputation: 22943

There is one tricky attack vector connected with external images: someone can post image which will be loaded from the external resource, which they control. After some time this url can be changed to return the request for the basic http authentication. So the other users will see windows requesting their login and password. Some users, especially non-experienced ones can enter the credentials of the attacking resources which will be sent to the attacker. So be careful with external resources.

Upvotes: 0

Gareth
Gareth

Reputation: 138082

Same origin policy stops any remote data from being accessible by a different domain. One of the main attacks this stops is being able to circumvent a user's login by waiting for them to be logged into another site, and then piggy-back your request on their authenticated session.

Whether the data loaded is an HTML snippet, an image file or anything else, it's blocked so you can't take advantage in any way (for example, by inspecting the pixel data of an image retrieved this way)

Upvotes: 4

Related Questions