Local HTML+Local JSON security

Asked Feb 17 '22 at 17:57

Active Feb 17 '22 at 18:50

Viewed 127 times

I have an application that generates a JSON file. It is to be consumed by a local HTML/JS file. My experience and Google/Stack Overflow seem to indicate the following:

This is easy when wrapping this into a JavaScript assignment and just use <script src>. This works just fine.
For security reasons, we can not read JSON directly from a local file (e.g. using require, or d3.json, using Chrome).

I don't understand the difference between these two methods w.r.t. security. I would have expected both to work, or neither. Am I missing something really obvious?

Tentative answer: <script src> checks for valid JS, while other fetch like operations would read anything?

edited Feb 17 '22 at 18:50

asked Feb 17 '22 at 17:57

Erwin Kalvelagen

15,677
2
14
39

Depends on what you mean by "local". Local to the client? Yes, because then the browser (and thereby the entire world) would be exposed to the client's file system, able to read files at will. However, a user can upload a file from their local file system to a website using the HTML `input type="file"` tag. That just sends a limited amount of information about the file to the browser. Local to the server? The client treats those the same as any other asset on the server. – Heretic Monkey Feb 17 '22 at 18:25
Sorry, I meant local on the clients file system. – Erwin Kalvelagen Feb 17 '22 at 18:26
So because ` – Erwin Kalvelagen Feb 17 '22 at 18:48
You can't use ` – Heretic Monkey Feb 17 '22 at 18:50
I use it all the time. Remember the HTML is also local. – Erwin Kalvelagen Feb 17 '22 at 18:51
But it was unclear what "local" meant. "local" can mean `http://localhost/index.html` – Heretic Monkey Feb 17 '22 at 18:55
The reason it works is that the HTML and the script are from the same origin (`file:`). The Fetch API and XHR are more strict, essentially, about origins, not allowing `file:` origins. – Heretic Monkey Feb 17 '22 at 18:58
Yes, obviously. I am asking why the difference. – Erwin Kalvelagen Feb 17 '22 at 19:00
Why the difference? Because HTML was invented ~30 years ago and Fetch only ~10 or so, and security increased in importance in the intervening 20 years? – Heretic Monkey Feb 17 '22 at 19:13

Local HTML+Local JSON security

0 Answers0