Tell me more ×
Code Review Stack Exchange is a question and answer site for peer programmer code reviews. It's 100% free, no registration required.
up vote 5 down vote favorite

I have a child iframe in my page that will load content from a different web application in a different virtual directory than the parent page.

The DOM will look roughly like this:

<html>
   <!-- Content from www.contoso.com/WebApp1/Home -->
   <div id="parentDiv" />
   <iframe>
      <!-- Content from www.contoso.com/WebApp2/Home -->
      <div id="childDiv" />
   </iframe>
</html>
  1. The user will log in to www.contoso.com/WebApp1.
  2. The user will load www.contoso.com/WebApp1/Home which contains an iframe with content from www.contoso.com/WebApp2/Home.
  3. To load content from www.contoso.com/WebApp2/Home the user must be logged in.

My Question:

  • Could I simply load the iframe with src=www.contoso.com/WebApp2/Home?sessionId={sessionIdFromTheParentCookie}, and write server-side code to trust the incoming sessionId and set a cookie for the child iframe?
  • At present, I can't see how this is any worse than the reality that a user could tamper with his/her client-side cookie an insert an arbitrary sessionId in it.
  • The sessionId must always be validated at the server, so what's the harm in supplying an arbitrary sessionId in the query string and asking the server to set the cookie?
share|improve this question
2  
I thought that cookies were shareable across an entire domain, unless you explicitly set the path when creating the cookie. Any cookies set when the user logs in should be available to the parent page and the iframe. This question on SO seems to support my notion: stackoverflow.com/questions/6578334/same-domain-iframe-cookies. Did I miss something? – Tag Dec 20 '12 at 1:36
@Tag: Yes, thank you. – Jim G. Dec 20 '12 at 1:43

1 Answer

up vote 2 down vote accepted

My Answer (best guess)

  • Tag is correct, out of security concer i would still not pass the session id as parameter(only if there is no other way)
  • It makes it harder to tamper with, if it is httplony see wikipedia
  • Links with sessionids could be bookmarked and after the end of the session they wont work, or they could beforwarded, and sesssions could be passed/shared, ...

Btw.: i found this link http://security.stackexchange.com/questions/14093/why-is-passing-the-session-id-as-url-parameter-insecure covering more or less the same topic.

I hope it helps

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.