Federation Manager Guide › Securing a Federated Environment › Protecting Federated Communication › Protecting a Federated Network Against Cross-Site Scripting

Protecting a Federated Network Against Cross-Site Scripting

A Cross Site Scripting (XSS) attack can occur when an application displays input text from a browser (typically, data from a post or data from query parameters on a URL) without filtering for characters that can form an executable script when displayed at the browser. The display of these characters can lead to an unwanted script being executed on the browser.

Federation Manager provides several JSPs for use with federation functionality. These JSPs check characters in a request to be sure that unsafe information in the output stream is not displayed in the browser.

When Federation Manager receives a request, the following JSPs scan the decoded values for cross-site scripting characters:

• idpdiscovery.jsp

  Used at the relying party for Identity Provider Discovery.

• linkaccount.jsp

  Used at the relying party for dynamic account linking.

• sample_application.jsp

  Used at the IDP to initiate single sign-on. This is a sample application you can use to direct the user first to the SSO Service and then to the custom web application. Typically, you use your own application.

• signoutconfirmurl.jsp

  Used at the Account Partner for WS-Federation sign out.

• unsolicited_application.jsp

  Used for IdP-initiated single sign-on when the user is sent directly to the web application and not initially to the SSO Service.

The pages scan the request for the following characters:

Each Federation Manager-provided JSP contains a variable that defines the characters to scan. Modify these JSPs to expand the character set.