The Document viewer accepts a postMessage from any origin and passes
event.data.url to Angular's sanitizer bypass, so a page on an unrelated domain chooses what
loads into the portal — and reads that origin's cookie jar.
/document route in a new window.message handler.{url: "javascript:…"} at that window. The handler never checks
event.origin, so it accepts it.bypassSecurityTrustResourceUrl() and binds it to
#myIframe's src, which executes it in the portal's own origin.document.cookie and sends the result back here for display.Sign in to the portal first, in this same browser. The script then reads your own live
AccessKeyId, SecretAccessKey, SessionToken and
open_id_token — the four values the portal's setLoginCredentials() writes
with document.cookie, which is why none of them can be HttpOnly.
Without a session it writes a marker into any of those cookies that is absent and reads that back instead,
so the read path still demonstrates. Everything is displayed on this page and sent nowhere.
Nothing yet. Press "Run the proof".