Cross-site leaks (XS-Leaks)
Cross-site leaks (also called XS-Leaks) are a class of attack in which an attacker's site can derive information about the target site, or about the user's relationship with the target site, by using web platform APIs that enable sites to interact with one another. The information leaked could include, for example:
- Whether the user has visited the target site.
- Whether the user is logged into the target site.
- What the user's ID on the site is.
- What the user has recently searched for on the site.
This might seem to be a much less damaging problem than, for example, a cross-site scripting attack, but it can still have serious consequences for users. For example:
- A user might have accounts on websites that they don't want to make public. Leaking this information to an attacker could expose them to extortion or retaliation from an oppressive government (for example, against a user seeking information about specific medical procedures).
- Knowing a user has an account on a site, especially if their user ID can be determined, can make a subsequent phishing attack much more convincing.
Unlike other attacks such as XSS or Clickjacking, cross-site leaks are not a single technique. Instead, they are a term for a whole class of attack which exploit weaknesses in the ways that browsers isolate websites from each other.
In this guide we will not attempt to describe every cross-site leak attack and defense. Instead, we'll start by describing a few example attacks, then outline the common underlying weaknesses that enable them, then describe some general defenses that can work against many known attacks.
Sample cross-site leaks
In this section we'll describe three different cross-site leaks, to give an idea of how they work.
- Leaking page existence using error events: in this attack, an attacker can determine whether particular endpoints in the target site return HTTP error codes, by attempting to load them as resources and listening for the
errorandloadevents. If certain pages are only available to logged-in users, the attacker can determine whether the user is signed into the target site. - Frame counting using window references: in this attack, the attacker gets a reference to a
windowobject hosting a page in the target site, for example as the return value of a call towindow.open(). The attacker can then determine the number of
const target = document.querySelector("iframe").contentWindow;
const frames = target.length;