How are you controlling security?

[rsshilli]

How are you controlling security?

Let's assume that I have:

• sub1.example.com
• sub2.example.com and they are using this library by sharing data with the origin set to a page on example.com.

Couldn't I set up sub1.example.com.malicious.com and point it to the origin set on example.com and then see all of the data in any user's browser whom I can trick into going to my malicious site?

[unadlib]

Of course, you could have use it like this.

new OriginStorage({
  broadcastChanges: true,
+ targetOrigin: 'http://sub1.example.com',
})

This will mean that only sub1.example.com will have access to this sharing data.

[unadlib]

If you want to support multiple site configurations, you can set it up like this.

new OriginStorage({
  broadcastChanges: true,
  targetOrigin: 'http://sub1.example.com',
})

new OriginStorage({
  broadcastChanges: true,
  targetOrigin: 'http://sub2.example.com',
})