Securing HTML contents from servers of same origin

user_633210 0
Viewed 104

It's not a common question, but I wonder if any tricks or upcoming standards exist.

Belows are a flow and what I want to implement.

  1. Web application loaded from server-side
  2. Client-side script loads some secure contents (not from #1) that need to be protected from web application provider. It could be shown to a user visually.
  3. Web application provider knows where are the secure contents (in Dom path) and possibly may try to catch it by putting a script
  4. However the secure contents shouldn't be hijacked from servers (even from the same origin) or from external application (even from developer tools if possible)

EDIT:

For better understanding, it's for use case where web application doesn't hold user data in their DB but loads the data from somewhere else. In case, I need to protect the data from web application, which is uncommon in regular web application.

privacy encryption security
1 Answers

You should use a content security policy (CSP) which would enable the browser to deny injection attacks. These can be a little tricky to setup correctly so I would use Report URI to help you get it going. The trick is to use report only mode first until you have validated the settings then switch to enforce.

user_17150310
Related