Search code examples
javascriptsecurityiframexsstumblr

How does Tumblr implement their global navigation?

Every blog on Tumblr has these two buttons at the top right corner of the page:

Tumblr

This global navigation is inside an iframe which points to tumblr.com.

How does Tumblr implement this feature securely? Tumblr themes can contain untrusted scripts and tumblogs can run on a custom domain (i.e not just *.tumblr.com).

I assume Tumblr takes measures to ensure that the navigation iframe's session cookie is not exposed to the blog in which it is embedded. What are those measures?

Additionally, does Tumblr whitelist the domains where the navigation iframe can be embedded?

Solution

  • the iframe solution seems to be the only possible way to go, otherwise it wouldn't be possible to carry the Tumblr session cookie, in the case of custom domain blogs.

    also, there's not much to think about in terms of security. the browser doesn't allow any scripts to access the iframe's contents, since the domains are different.