The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

18
votes
3answers
3k views

What are the risks of using a CDN to speed up my website? How do I avoid them?

Content Delivery Networks (CDNs) are well known to speed up the performance of a website, but they create the obvious security risks if someone were to change the code that resides on the CDN. What ...
6
votes
5answers
7k views

Obfuscating JavaScript code

Some Flash developers are afraid of JavaScript. Their point of view: Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
5
votes
2answers
168 views

User entered Javascript security implications

I'm creating a web site that lets people create their own site using a subdomain. Are there any security implications by letting people add custom javascript to their pages? If so, which ones? XSS? ...
5
votes
2answers
1k views

Is a JavaScript implementation of AES any less secure than other language implementations?

There are a few JavaScript AES implementations available such as Gibberish-aes So assuming the AES algorithm has been implemented correctly in this library then it should be as secure as any other ...
4
votes
2answers
2k views

UTF-7 XSS attacks in modern browsers

I've recently read about utf-7 XSS-attacks (i.e. Ned Batchelders article at http://nedbatchelder.com/blog/200704/xss_with_utf7.html) but could not get any UTF-7 attack to work in modern browsers. (I ...
4
votes
1answer
4k views

Can your Windows or Linux username be exposed to websites?

For example: Accessing a website with javascript enabled can expose information such as browser, fonts and local time. Can it, theoretically, expose your Windows or Linux username? Will saving a ...
3
votes
4answers
611 views

How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?

Many website owners integrate Google analytics, various Facebook or Twitter social media javascript plug ins into their web pages. The problem is that this trust seems to be "all or nothing", meaning ...
3
votes
2answers
2k views

Is XSS possible here? Challenge

Is possible to bypass my regex and execute any javascript? <script> function json(a){ if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, ...
2
votes
2answers
181 views

Securing a Shuffle Algorithm

After reading about writing a secure shuffle algorithm, I realized that my module that generates a password is only as strong as my PRNG, which in this case is Math.random(). I'm confused as to how to ...
2
votes
2answers
3k views

Are these both cross frame scripting attacks?

I've received a recent security review of a website which mentioned it had a cross frame scripting vulnerability. In short, it mentioned that a malicious site could load the page up in an iframe, ...
2
votes
1answer
537 views

How to hide victim pop-up in clickjacking?

I am testing a web application for click-jacking vulnerability. The attack works fine for single clicks, however i am trying to delete a file and the hidden frame (victim) throws a pop-up ...
1
vote
2answers
712 views

Digital Signatures of XML, PDF and Office Documents on every platform

I'm trying to develop a website that performs digital signatures on client-side and then sent the signed document to the server-side. I want to do the signatures on client, due to the fact of not ...
1
vote
1answer
348 views

How do you limit javascript api to a domain?

Ok, many of you now the scenario: you login to developer.sayLinkedIn.com, create an app with credentials and define the domain in witch that key is allowed to "run". The question is, from a api ...
1
vote
4answers
2k views

Shall I need to use MD5 algorithm in both JavaScript and PHP for login authentication?

I have a login form with username and password. I post this form data to a PHP file. For security reasons I want to encrypt my password in the database and network. Now I have done now following ...
1
vote
2answers
580 views

AVG Website Scan, Chance of 'Potential Threat'?

In a recent question I asked about investigating websites for viruses. The answers were very helpful, I ended up using the AVG website scanner. First I used it on our website and found it was clean, ...