Collaborate Disseminate
I have been reading about the security and performance implications of rel="noopener" and rel="noreferrer" in links with target="_blank". These are some of the observations:
if you open a link in a new tab fr… Continue reading using rel="noreferer" without rel="noopener" or without target="_blank"
I have recently been reading about scenarios where browser might block automatic redirects. One scenario that i came across is what chrome calls as "tab-under". When the user clicks on a link to open in a new tab, the original ta… Continue reading Tab under behaviour blocking
I have recently been reading about reverse tabnabbing, where a child window can change the url of the parent window if it has access to window.opener (which it has by default unless you explicitly disallow it)
In this case the phishing att… Continue reading Reverse tabnabbing: why not redirect the user in the new tab itself instead of the parent tab?
I am trying to understand various reasons where the browser would block redirects to another site. This lead me to have an understanding of why do sites have an interstitial redirect page which says redirecting you in 5 seconds, please cli… Continue reading When do browsers block automatic redirects?
I understand that XSS attacks can access all globals (like cookies, storage, etc) within the context of the running javascript code, but I would like to understand if they could also have access to any in memory variables as well?
For exam… Continue reading What parts of the javascript code can an XSS attack access?
I am trying to learn basics of web security vulnerabilities.
I have found a website, where on reset password, you get a link in the email with a token, and when you click this link, the webpage opens and the url is reflected in a form acti… Continue reading Reflected XSS in form action – understanding