注销用户访问单个Web应用程序页面

Question

This is an extension of my earlier XSS question .

Assuming that there isn't a Regex strong enough to guarantee XSS saftey for user entered URLs I'm looking at using a redirect.

(Although if you do have one please add it under the other question)

We have user input web addresses, so:

stackoverflow.com

They want a link to appear for other users, so:

<a href="http://stackoverflow.com">stackoverflow.com</a>

To reduce the risk of hacking I'm planning to use a warning page, so the link becomes:

<a href="leavingSite.aspx?linkid=1234" target="_blank">stackoverflow.com</a>

Then on that page there will be a warning message and a plain link to the original link:

<a href="javascript:alert('oh noes! xss!');">Following this link at your own risk!</a>

As we use a lot of Ajax I want to make that leaving-site page a walled garden of sorts, ideally by essentially logging the user out in that page only. I want them to stay logged in on the original page.

Then if someone does get past the santisation Regex they can't access anything as the duped user.

Anyone know how to do this? Is it possible to log out one window/tab without logging them all out? We support IE & FX, but ideally a solution would work in Opera/Chrome/Safari too.

Answer 1

仅在一个选项卡/窗口中注销某人是不可能的。

Answer 2

将Cookie限制为www.example.com，并在links.example.com上具有转发页面