Major sites running unauthenticated JavaScript on their payment pages

Re:Major sites running unauthenticated JavaScript on their p... by woogley on Thursday November 29, 2018 @09:51AM (#18560532)

I have never heard of this. Can you share a link that goes into detail about this behavior? I don't immediately see anything on MDN's same-origin page talking about it

[ Parent | on HN ]

Re:Major sites running unauthenticated JavaScript on their p... by benmmurphy on Thursday November 29, 2018 @10:54AM (#18561064)

I'm 99% sure this is not a thing and if it was it would be incredibly broken and not secure and most non-trivial pages relying on it for security would be vulnerable to the third party script.

Anyway. This can easily be proved one way or another. `Here is an example that shows a third party script accessing a first party domain. There is no CORs as far as I can see:

https://jsfiddle.net/aopmtn46/

If you open the console you will see "STATUS 404" which is not possible if same origin on third party scripts is enforced.

[ Parent | on HN ]

Re:Major sites running unauthenticated JavaScript on their p... by woogley on Thursday November 29, 2018 @01:28PM (#18562491)

thank you for this test!

[ Parent | on HN ]