Collaborate Disseminate
Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B.
Site B will return an image response, and in that response a cookie will be set (cookie of Site B’s domain).
This is being … Continue reading security issues related to setting cookie using an <img> tag
I am running a website that contains data that our users can access if they login.
Someone else has created an Android app that lets users access that data as well. They enter their credentials, and the app then connects to … Continue reading How to stop app from fetching data from my website?
A fellow developer and I were experiencing a weird issue with our application in the past couple of days. Specifically, he’s writing the API and I’m writing the web front end. Since the UI runs from a different port, we have… Continue reading What’s the purpose of the preflight check on CORS requests?
From what I’ve seen, someone can add the following code to a malicious site (lets say: http://sth.malicioussite.com) and be able to perform ajax post requests to a 3rd party site, along with any cookies set before:
var xhr =… Continue reading Is xhr.withCredentials making POST endpoints vulnerable to CSRF?
tl;dr the Cookie-to-header-token method can’t work due to the CSRF token cookie not being readable by the client in any way. Is sending the token in a header, and having the client save it in a cookie immediately considered a… Continue reading How to implement CSRF protection with a cross origin request (CORS)
I went to an article on medium.com earlier today, and instead of the annoying full screen popup they usually show to returning visitors, I saw this in the upper right corner:
Right there on the medium page they have my nam… Continue reading How does medium.com know my google account?
As everyone knows, SE has had this feature where one login from one network, she/he logs in globally across all SE networks. This is done of course using local storage.
I however want to login using server-to-server token. … Continue reading Token-based server-to-server authentication of clients
Trying to understand if Netlogon Debug Logging audits both protocols or Kerberos.
Continue reading Does Netlogon Debug Mode Audit both NTLM and Kerberos?
I need some clarifications about the problems that CORS (Cross-Origin Resource Sharing) can cause.
Let’s suppose that site A.COM has enabled CORS, in particular:
Access-Control-Allow-Origin can be set to any website in the … Continue reading CORS clarification
Suppose www.youtube.com have no X-Frame-Options set.
Imagine I’m already logged in to YouTube. Now from another web page in the same browser I’m loading YouTube in an iframe, will the browser send all the auth-cookies to the… Continue reading Loading a logged in page in an iframe