Cross-Domain Security in Web Applications

Abstract

This chapter explores in detail security issues that arise from interactions between multiple web sites or web-based applications that a user is visiting with the same browser. Since such security concerns usually involve web-based resources or applications in two or more different domains,¹ such issues are called cross-domain security issues. The purpose of this chapter is twofold: First, it serves to demonstrate that in security, the “devil is often in the details,” and that an aspect of application security that at first seems fairly straightforward actually turns out to be rather complex. As such, this chapter assumes a deeper knowledge of HTML and web technologies to understand all the detail. You are encouraged to re-read Chapter 7 to freshen up on the basics before attacking this chapter, and also to consult the HTML specification when necessary as you read through this chapter. Second, we believe that to date no comprehensive treatment of cross-domain security is available, and we fill that gap.

The term domain relates to the Domain Name System (DNS), the naming scheme for hosts, such as web servers, on the Internet.