5
\$\begingroup\$

I have a child iframe in my page that will load content from a different web application in a different virtual directory than the parent page.

The DOM will look roughly like this:

<html>
   <!-- Content from www.contoso.com/WebApp1/Home -->
   <div id="parentDiv" />
   <iframe>
      <!-- Content from www.contoso.com/WebApp2/Home -->
      <div id="childDiv" />
   </iframe>
</html>
  1. The user will log in to www.contoso.com/WebApp1.
  2. The user will load www.contoso.com/WebApp1/Home which contains an iframe with content from www.contoso.com/WebApp2/Home.
  3. To load content from www.contoso.com/WebApp2/Home the user must be logged in.

My Question:

  • Could I simply load the iframe with src=www.contoso.com/WebApp2/Home?sessionId={sessionIdFromTheParentCookie}, and write server-side code to trust the incoming sessionId and set a cookie for the child iframe?
  • At present, I can't see how this is any worse than the reality that a user could tamper with his/her client-side cookie an insert an arbitrary sessionId in it.
  • The sessionId must always be validated at the server, so what's the harm in supplying an arbitrary sessionId in the query string and asking the server to set the cookie?
\$\endgroup\$
1
  • 3
    \$\begingroup\$ I thought that cookies were shareable across an entire domain, unless you explicitly set the path when creating the cookie. Any cookies set when the user logs in should be available to the parent page and the iframe. This question on SO seems to support my notion: stackoverflow.com/questions/6578334/same-domain-iframe-cookies. Did I miss something? \$\endgroup\$
    – Tag
    Commented Dec 20, 2012 at 1:36

1 Answer 1

Reset to default
2
\$\begingroup\$

My Answer (best guess)

  • Tag is correct, out of security concer i would still not pass the session id as parameter(only if there is no other way)
  • It makes it harder to tamper with, if it is httplony see wikipedia
  • Links with sessionids could be bookmarked and after the end of the session they wont work, or they could beforwarded, and sesssions could be passed/shared, ...

Btw.: i found this link https://security.stackexchange.com/questions/14093/why-is-passing-the-session-id-as-url-parameter-insecure covering more or less the same topic.

I hope it helps

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.