Web origin checking in exposed C# object

[harrycis]

I'd like to check the web origin in the exported C# object so that methods only functions for certain origins. It is for security reasons that the object should only be involved with trusted origins.

On iOS, exported method handler receives a WKScriptMessage message, within which a secure origin of the message posting page can be found and used to guard the invocation.

There is not no such mechanism in cefsharp, is there a way to only bind a C# object to an origin up-front?

[amaitland]

is there a way to only bind a C# object to an origin up-front?

The preferred approach is to bind an object in JavaScript. You can choose to only bind a object for a specific domain.

https://github.com/cefsharp/CefSharp/wiki/General-Usage#binding-an-async-object-in-javascript
https://github.com/cefsharp/CefSharp/wiki/JavaScript-Binding-API

To invoke binding an object from .Net you can use EvaluateScriptAsPromiseAsync or
http://cefsharp.github.io/api/90.6.x/html/M_CefSharp_JavascriptBindingExtensions_EnsureObjectBoundAsync.htm

For reference

CefSharp/CefSharp/JavascriptBinding/JavascriptBindingExtensions.cs

Line 24 in 4608924

public static Task<IList<string>> EnsureObjectBoundAsync(this IWebBrowser browser, params string[] names)

[harrycis]

Thanks amaitland@ for the quick response.

Is CefSharp.BindObjectAsync an exported method to JS context? If yes, wouldn't it allow any origin to bind the registered C# object via JS? Fundamentally, the local (C#) object should be the one deciding which origin it is secure to be exposed. But it appears that the capability doesn't exist. Let me know if I misunderstand anything.

[amaitland]

You can use a separate ChromiumWebBrowser instance for unsecured origins and disable creation of the CefSharp object see #3571

You can also rename the CefSharp object see http://cefsharp.github.io/api/90.6.x/html/P_CefSharp_JavascriptBinding_JavascriptBindingSettings_JavascriptBindingApiGlobalObjectName.htm

It's possible that a whitelist could be added to only create the CefSharp object for a set list of origins.

[harrycis]

So origin changes as users navigate throughout pages. Disabling/enabling creation of CefSharp object would then need to be altered dynamically on the fly. What's the best way to achieve it? What's more, as the property would apply to entire ChromiumWebBrowser instance, it would affect all windows and origins if there is any iframe, would't it?

As for renaming object name, it is secure through obscurity, which can be defeated by reversing engineering the program, and is not a security boundary therefore.

[amaitland]

So origin changes as users navigate throughout pages. Disabling/enabling creation of CefSharp object would then need to be altered dynamically on the fly. What's the best way to achieve it?

There is no option for dynamically changing this value. I'm suggesting using one ChromiumWebBrowser instance for your trusted origins and a second ChromiumWebBrowser instance for your untrusted origins. You can then use a separate RequestContext for each instance with a different CachePath, ensuring cookies, cache, local storage etc are isolated. This would be a precautionary step, I'm not aware of any specific vulnerability.

If you need to support accessing known trusted origins and untrusted origins in a single ChromiumWebBrowser then realistically a whitelist would need to be added.

As for renaming object name, it is secure through obscurity, which can be defeated by reversing engineering the program, and is not a security boundary therefore.

I'm simply stating what is currently possible. I'm not aware of your security requirements, determining what meets your definition of secure is entirely up to you. There are possibly cases where randomly generating the name at runtime would be considered secure enough.

I will also point out that currently CefSharp does not currently implent the chromium sandbox as it requires statically linking of cef_sandbox.lib in both browser process and sub-processes. See https://bitbucket.org/chromiumembedded/cef/wiki/SandboxSetup#markdown-header-windows

If you require sandbox then you might need to consider using a different browser. (Possibly you could create a c++ exe to statically link the lib file and bootstrap the .Net runtime, that's a topic for a different discussion).