Databases
StackOverflow2013
Postsdbo
POXSS between HTTP and HTTPS versions of the same domain
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POXSS between HTTP and HTTPS versions of the same domain
    primarykey
    data
    text
    <p>What I'm trying to accomplish is an inline login using ajax that does the following:</p> <ol> <li><p>Login link is displayed on an unsecured HTTP page, lets say "<a href="http://www.somedomain.com/somepage/" rel="nofollow">http://www.somedomain.com/somepage/</a>" <strong>No login info is collected here</strong></p></li> <li><p>When clicked the login link creates an iframe with a src pointing to "<a href="https://www.somedomain.com/rest_api/values/" rel="nofollow">https://www.somedomain.com/rest_api/values/</a>" <strong>This is where the login form is first displayed, via HTTPS</strong></p></li> <li><p>Within the new iframe popup, the user is presented a login form which itself is secure having been loaded via HTTPS, user fills in form and clicks continue which posts back to itself.</p></li> <li><p>Assuming user is logged in successfully a jquery call is made to a script accessible via <code>window.parent.document</code> which updates the original page with the current user widget, and then calls for the iframe to be destroyed.</p></li> </ol> <p>This works great when I force the iframe to use the same domain and protocol, but as soon as I come in on HTTP and force the IFRAME to load the login script with HTTPS, I get the dreaded "Permission denied to access property 'document'" error in Firebug after a successful login.</p> <p>I understand that the <code>Access-Control-Allow-Origin</code> header needs to be set, so it's dynamically set to use the HTTPS version of what ever domain the page is being requested under, and I've verified this in the Header Response in Firebug on the original page request.</p> <p>So why am I still getting the error, the response header shows:</p> <pre><code>Access-Control-Allow-Origin: https://www.somedomain.com </code></pre> <p>so is there something else I need to set, or is the problem possibly somewhere else?</p> <p>Thanks for any help!</p> <hr> <p>EDIT: Updated above to point out that I am not stupid and that the login form is indeed loaded securely ;)</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USoucil
    1. USoucil
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POXSS between HTTP and HTTPS versions of the same domain
      1. This table or related slice is empty.
      1. VTUpMod
    1. COAt step 1, you've already failed. The login page must be served over HTTPS, or you will have very little security
      singulars
      1. POXSS between HTTP and HTTPS versions of the same domain
      1. USSLaks
    2. CO@SLaks Maybe I wasn't clear, when you click login to create the IFRAME, you aren't filling anything in yet, all you're doing is launching the script that creates the IFRAME, and sets the src to load the login form within it via HTTPS. So it is indeed secure.
      singulars
      1. POXSS between HTTP and HTTPS versions of the same domain
      1. USoucil
    3. CO@SLaks Am i misinterpreting? The way i read it is the login form is being presented in an iFrame pointing to an https domain. so, the login form itself is on https, it just can't talk to the parent page because it is of a different origin (not https)
      singulars
      1. POXSS between HTTP and HTTPS versions of the same domain
      1. USKevin B
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload