Skip to content

Security enhancements

Compare
Choose a tag to compare
@mlissner mlissner released this 25 Jan 20:54

This release makes the extensions more secure in the event that the CourtListener server is hacked by a sophisticated adversary. This is a "belt and suspenders" kind of fix that provides additional security beyond what was previously in the extension. If you are an average user of RECAP, there's no need to be concerned — this is just us making things more secure than they already were.

For the technically curious, this change provides a default dataType to every jQuery request that we send to the CourtListener server. This makes it so that if the CourtListener server were hacked, it could not be used to send RECAP users JSONP data. JSONP is dangerous because it can be used to send arbitrary JavaScript, so the scope of this is that if the server were hacked, it could be used to send arbitrary JavaScript to RECAP users when they were on PACER websites. That would not be good, and we're happy to eliminate this possibility.

This new version will be rolling out to Chrome and Firefox (and hopefully Opera) over the next 24 hours.