Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
If I have a reference to an external third party JavaScript file on my website, what are the security implications? Can the JavaScript file be used to steal cookies?
One example of this is the Google Analytics JavaScript reference file.
Could the third party technically steal cookies or any other sensitive information from my logged on users (XSS)?
The whole cross domain scripting has me confused sometimes.
Thanks!
Yes, the external JavaScript can do anything your own scripts can do. That includes reading cookies and worse: doing things on behalve of your visitors.
Only include JavaScripts from external websites you really, really trust.