CODEWITHSUNDEEP
javascriptxss
Sachin Jain
Sachin Jain

Reputation: 21842

Solving Cross Site Scripting Resource Sharing

I want to load an external website in an iframe. But faced issues due to Same-Origin-Same-domain policy. So for solving this I used the proxy solution in which we send our request to a proxy file (I wrote in java) and then it requests the server and return back the response. This is working perfectly fine.

But using this method all the pages are not correctly loaded into my iframe. Currently I am working on localhost. The problem i am facing is there are some errors in fetching the page like:- On fetching www.google.com i got these errors:-

GET http://localhost:8080/images/srpr/logo1w.png 404 (Not Found)

a.html:101 GET http://localhost:8080/extern_js/f/CgJlbhICaW4gACswRTgALCswWjgALCswDjgALCswFzgALCswPDgALCswUTgALCswCjgAmgICaGUsKzCYATgALCswFjgALCswGTgBLCswQTgALCswTTgALCswTjgALCswVDgALCswaTgALCswkAE4ACwrMJIBOAAsKzDVATgALCsw2AE4ACwrMBg4ACwrMCY4ACyAAlCQAnA/Q4V9Cbp7fuo.js 404 (Not Found)

These errors are coming because relative path has been specified in the webpage i am fetching (I guess). Am I right? If I am then how to correct these things so that such errors can be corrected.

After searching on net, I got a site which does this perfectly. Please checkout http://optimizely.com

Upvotes: 0

Views: 298

Answers (2)

jfriend00
jfriend00

Reputation: 707986

The issue appears to be that if a site uses relative HREFs (relative to the domain/path that the site was loaded from), then your solution will cause problems because you've changed the apparent load domain/path to something else.

One possibility is for you to inject a tag into the right place in the page (in the <head> section) like this to properly set the base href:

<base href="http://www.google.com">

See this article for more info: http://www.drostdesigns.com/base-href-tag/

This solution is not foolproof though because if the site is already using a <base href="xxx"> tag, your may cause problems and if javascript code is doing manipulations based on the loaded domain/path, the base href won't fix that. Whether those issues matter or not will depend upon the particular page.

If the base href solution doesn't work, you might have to proxy all the other requests for resources too (images, ajax calls, etc...) so that everything destined for the other host, but requested from you is proxied appropriately. This would be more foolproof.

Upvotes: 1

Authman Apatira
Authman Apatira

Reputation: 4054

There is no way we can tell just by the description you've posted so far of the problem.. but if the answer is indeed as you have alluded to, then simply correct it -- whenever you get a relative link, make it a fully qualified one by prepending the domain from within your proxying script.

Upvotes: 0

Related Questions