tags:

views:

75

answers:

1
+1  Q: 

Javascript reference external script file - security implications

Hi,

If I have a reference to an external third party JavaScript file on my website, what are the security implications? Can the JavaScript file be used to steal cookies?

One example of this is the Google Analytics JavaScript reference file.

Could the third party technically steal cookies or any other sensitive information from my logged on users (XSS)?

The whole cross domain scripting has me confused sometimes.

Thanks!

+2  A: 

Yes, the external JavaScript can do anything your own scripts can do. That includes reading cookies and worse: doing things on behalve of your visitors.

Only include JavaScripts from external websites you really, really trust.

edwin  2010-05-07 21:57:46

related questions

What JavaScript patterns do you use most?
Javascript events
What style do you use for creating an "class" in JavaScript?
Graphing JavaScript Library
What's the difference in closure style
Getting the text from a drop-down box
How to specify javascript to run when ModalPopupExtender is shown
Length of Javascript Associative Array
How Do I Post and then redirect to an external URL from ASP.Net?
How to set up a CSS switcher in ASP.NET
Wrapping lists into columns
Javascript keyboard events primer? (or rather: help me with my custom dropdown)
Http Auth in a Firefox 3 bookmarklet
Best Debugging Tools for JavaScript/xulrunner Development
How can I turn a string of HTML into a DOM object in a Firefox extension?
Call ASP.NET Function From Javascript?
Javascript troubleshooting tools in IE
MAC addresses in JavaScript
Capturing TAB key in text box
CSS Background Color in Javascript
How can I make the browser see CSS and Javascript changes?
Triple Quotes? How do I delimit a databound Javascript string parameter in ASP.NET?
ASP .Net Custom Client-Side Validation
What JavaScript library would you choose for a new project and why?
Detecting font in JavaScript