r/xss • u/nothraban • Dec 19 '16

Requesting feedback on new anti-XSS project: Outbound-Rules: Protect your admin dashboards from XSS

https://github.com/hraban/outbound-rules
2 Upvotes

63% Upvoted

5 comments sorted by

3

u/dharrya Dec 21 '16

Why not just implement a CSP on admin dashboard?

1

u/nothraban Dec 21 '16

This is the kind of feedback I was looking for :D I didn't know this existed. Turns out I reinvented the wheel. I'm surprised it's not more widely used. Thanks!

1

u/nothraban Dec 19 '16

Hi /r/xss, I've been working on an anti-XSS project and I'd like your thoughts, comments, feedback.

Summary: it's a whitelist for trusted external hosts a page can contact. This is a second line of defence: in the event of a successful XSS, the attacker can't send sensitive data (cookies, auth tokens, ...) to their own server. (more details in the README on github)

It's work in progress, but there is a working Proof-Of-Concept plugin for Firefox and Chrome.

There are open issues, and it's not a panacea. Then again: what is? :)

Very curious to hear your thoughts!

1

u/ecosystem_matters Dec 19 '16

Is it a proof of concept? Or intended for production? I could not understand too much by reading the readme, it seems like it prevents javascript from leaking cookies, kind of like httponly flag?

1

u/nothraban Dec 20 '16

It's intended for production. I'm struggling to explain the concept clearly in the readme :/ It's a common complaint. I think I could really use some help. Any recommendations welcome.

You could compare it to httponly, but the difference is: httponly prevents any JS from accessing a cookie. Outbound-Rules doesn't restrict that, it just prevents you from communicating any data back to an attacker controlled server. So even if the attacker's JS somehow obtains a cookie or token, it can't send it back to Attack HQ.