search

LavaMoat / snow

Use Snow to finally secure your web app's same origin realms!
https://lavamoat.github.io/snow/demo/
MIT License
100 stars 9 forks source link

Better communicate Snow needs to be implemented in all pages #122

Closed weizman closed 11 months ago

weizman commented 1 year ago

CTX https://github.com/LavaMoat/snow/issues/109#issuecomment-1618674481:

What would also help is if we communicate the importance of implementing Snow in all same origin pages, this should help with issues such as https://github.com/LavaMoat/snow/issues/73

CTX 2 https://github.com/LavaMoat/snow/issues/73#issuecomment-1638388215:

https://github.com/LavaMoat/snow/pull/128 fixes some problems from https://github.com/LavaMoat/snow/pull/124, bringing us closer to a solution for this problem. Next step would be to address https://github.com/LavaMoat/snow/issues/122, so that it's clear for the users what they need to do to protect themselves fully against https://github.com/LavaMoat/snow/issues/73

Bottom line:

Past PRs make it so that exploiting #73 isn't possible if ONE of the following TWO conditions is met:

  1. Snow is correctly implemented in ALL same origin HTML pages served by the server (including 404 and such).

    • 128 is designed so that calling Snow is only necessary in the top main realm, you just need to include the bundle in all pages (or call Snow in all pages too, either way is fine)

  2. Pages correctly allow frame-src CSP only to same-origin or well trusted origins. allowing untrusted cross origin iframes allows #73 to exist when condition (1) isn't met.
    • Note: is that true when taking open() into consideration too? Need to research...

This ⬆️ needs to be correctly communicated for #73 to be considered addressed.

weizman commented 11 months ago

135 solves this mainly by communicating section 1 (section 2 however is less relevant actually)