0

I'm writing an odd kind of webapp that is designed to communicate with other sites loaded into the browser. This is fairly trivial to do via MessageChannels. Now, these applications must access protected resources and must get authorization from the user. Using something that would allow these other applications to communicate with a server (such as OAuth) is not an option since there is no server: Support for P2P and E2EE connections is required. One idea I had for limiting access was to use Symbols: For example, if a message is sent that references a resource, it may contain the Symbol for that resource. Then, if the other application wants that resource, it can retrieve it by using that Symbol.

The problem is that I'm not sure this is secure. Is there any way to deliberately create a Symbol that is not unique? If so, this could potentially be used as an attack vector in my webapp: A malicious "client" application could just keep guessing Symbols until it finds one that corresponds to something useful.

Also, if there's a better way of doing this or you see any other issues with it, feel free to let me know ;)

EDIT: To clarify: Application A creates a Symbol to give to Application B. With this Symbol, Application B can access certain resources (files, objects, etc.) which are sent back to it. Is there any way for Application C to get access to a Symbol that is equivalent to the one given to Application B without actually being given the Symbol from either Application A or B?

EDIT: Confirmed that Symbols can, in no way, be transferred across MessageChannels. So there's little point to the question...

somebody0
  • 53
  • 6
  • 1
    Define "secure" here. If there's absolutely no server and everything is happening inside the browser, then there is no security. By definition, you'll need to send all the necessary code and data to the browser which then evaluates whether to show it to the user or not. But it's all already on the user's computer, trivially inspectable if one cares to do so. If you must keep something away from a user through authorisation, there's no substitute to doing the authorisation on a trusted machine that is not the user's machine. – deceze Apr 14 '20 at 14:15
  • "Secure" would mean that the "client" application that my application is communicating with can't create a Symbol that it has not been given directly (in this case, through a `MessageChannel`). This is **not** security from the user, browser, or computer. – somebody0 Apr 14 '20 at 14:17
  • In bit more in-detail example would help clarify what you're asking exactly… – deceze Apr 14 '20 at 14:20
  • 1
    No, there is no way to create two equal symbols. I'm not sure you can send those through channels though. – Jonas Wilms Apr 14 '20 at 14:30

1 Answers1

0

Symbols cannot be transferred through MessageChannels. Tested in Firefox.

somebody0
  • 53
  • 6