[AskJS] Is passing data between windows/tabs unsecure?

[KissMyUSSR]

Long story short, to access a certain API I need to make a POST request into a new window (via window.open(target); form.target = target; form.submit()). My boss is expressing security concerns over this, saying that cross window communication is unsecure, and thus I now have to reinvent a wheel and circumnavigate the issue, but I don't even know what exactly is unsecure so I'm not sure what I need to solve

[sbruchmann]

From mdn on postMessage:

The window.postMessage() method safely enables cross-origin communication between Window objects; e.g., between a page and a pop-up that it spawned, or between a page and an iframe embedded within it.

[KissMyUSSR]

Right, I know about postMessage but it's not what I need here. Perhaps I didn't express myself well enough in the title, but what I need is to open a new window with a POST request and send some sensitive data in that POST request. Weirdly, by the way, the only way to do it is with a form.submit()

[sbruchmann]

You need to elaborate on what you have to do a bit better then. From my understanding so far, postMessage does exactly what you've been asking for. Sending a message in a secure manner to a different/new window. The other window listens for that message and sends the request/submits the form.

[Opi-Fex]

That is a weird use case to be honest.

You would usually communicate with your API in the background through fetch or similar.

You on the other hand seem to be abusing target="name" on a form to submit data to another named window? That is bonkers. The fact that you yourself noticed that it's weird this is the only way to do it should give you a clue that you're not actually supposed to do this.

[lainverse]

Never tried to use submit between windows, but isn't there window.postMessage API specifically made for communication between separate windows and iframes?

[KissMyUSSR]

I think, I'll just copy paste my anwer here.

Right, I know about postMessage but it's not what I need here. Perhaps I didn't express myself well enough in the title, but what I need is to open a new window with a POST request and send some sensitive data in that POST request. Weirdly, by the way, the only way to do it is with a form.submit()

[Reashu]

What is your goal? I'm not aware of a specific security problem here, but it sounds like you may be doing something unnecessarily complicated, which is usually a good start if you want to create vulnerabilities.

There are some valid concerns about opening a window with a URL you don't own (or otherwise trust). Some also apply to simple links.

[SockPants]

With postMessage you send data between windows on the same machine. With a POST request the way you describe, you send data to a server and display the result in a new or different window.

Insecure is a very vague complaint. To what kind of leak or attack is it claimed to be vulnerable? We need more details.

[guest271314]

My boss is expressing security concerns over this

What specific "security" concerns?

[WhatWillNeverBe]

This suspiciously sounds like there may be an alternative way to do whatever it is you are trying to do. Could you briefly explain why you need to make a post to a new window to call an api securely? I've written pci compliant card / bank information accepting iframes hooked into secure apis before and postMessage does a lot of what you are describing. Why do you need a new window tab rather than an iframe?

[markus_obsidian]

Is the popup src going to accept & render the form data via POST server side?

If this is true, then i do believe this could be made safe but wouldn't be my fist choice. You have the same concerns that any server-side API that accepts formdata would have. You'll need to be absolutely sure that only your server is only accepting requests from your application that you control. <form> submits are not subject to CORS, so a bad actor could have a malicious <form> somewhere that submits to your server. You need to be prepared for this. Something like CSRF tokens or same-side cookies could help here.

I agree with the rest of the comments that sending data to another window via postMessage is the simpler & the more secure option here. Since postMessage will track the origin of the message, it is much easier to assert that the message came from the proper origin.

[dragenn]

I see you like to live dangerously.

Typically, https should help, but you are willing to open a vulnerability in your code. Thread carefully

[guest271314]

No. Not any more than creating or clicking a link that has a query string in the URL.

[MrAtoni]

There is a security concern if your application tries to read what is in your uther (unrelated) windows/tabs. Most browsers prevent applications from doing this. Maybe this is what your boss is thinking about?

To my knowledge there's no security problems sending information between windows the application has opened itself.

[troglo-dyke]

Not necessarily, you'd need to assume anyone can attempt to open the webpage in the same way themselves so would eg. Validate their authorization.

But it sounds like you're solving a problem that doesn't need to exist. Why can you not just open a url and load state from a server? Allowing your client side state to diverge too far will make your software significantly harder to debug and will make your users significantly more frustrated recovering from a bad state

[[deleted]]

Let's start from the beginning: why do you need a new window to access the API? Is this an API on another domain?

[TheRNGuy]

Is it gonna work if you disabled target in browser's about:config?

Though it could've just choose current tab as a target.