The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

1
vote
2answers
74 views

What's the best way to secure the responses in a single page web app after logout?

I've read some of the great responses to storing and passing session keys in a single page web application (i.e., a web "site" that runs mostly on the client-side, getting data from the server by ...
1
vote
1answer
179 views

Can a Java servlet filter be used to pull out scripts that aren't whitelisted?

I might be asking a similar question to this: Whitelisting DOM elements to defeat XSS But I think my proposed solution is different and I was wondering if I could get the community to comment on ...
0
votes
0answers
13 views

Best practices to invalidate JWT while changing passwords and logout in node.js?

I would like to know the best practices to invalidate JWT without hitting db while changing password/logout. I have the idea below to handle above 2 cases by hitting the user database. 1.Incase of ...
2
votes
1answer
51 views

Securely identify clients by web app

I have a web service S that provides certain services. There are two web apps, A1 and A2, both on different servers within the same VPN, which I trust and want to grant access to my web service. ...
1
vote
1answer
100 views

Attack using weird characters followed by some javascript in a URL?

I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this: /js/bundles/,!0):this.element.propAttr( ...
0
votes
3answers
469 views

bot detection via browser fingerprinting

I've recently noticed that a few companies have begun to offer bot and scraping protection services based on the idea of browser fingerprinting to detect them, and then blocking the specific ...
1
vote
2answers
100 views

XSS outside of the DOM

I have the following JS (using jQuery for brevity's sake but it isn't necessary for the question): $("<i></i>").html(userInput); Is it possible for someone to input some string, ...
1
vote
1answer
28 views

Limiting latter dom-based XSS when setting document.title

Given some JavaScript which modifies the page's title by taking in variable data document.title = someVariable I am looking to address dom based XSS while keeping the title fairly readable. ...
2
votes
2answers
64 views

Security of Firefox extensions such as Mailvelope

I am asking these question because I am not very familiar with javascript or the Firefox plugin/extension system. The specific context is the Mailvelope pgp extension but the questions are general and ...
-1
votes
0answers
44 views

How can I get a big site to fix security-errors? [duplicate]

On an online-shop of a giant multinational cooperation (building cars) I found some security-errors (XSS and Javascript-Injections) by just playing around. I emailed them to the manufacturer and ...
0
votes
0answers
63 views

Securing my API: concept of access tokens

First of all I want to excuse for the bad spelling and grammar. English is not my mother tongue. I have built a JSON communication between a front-end (website) and my Node.js web server. I want to ...
4
votes
1answer
320 views

How secure is JavaScript based OAuth 2.0

JavaScript based OAuth exposes the client ID of the application and it trusts only on the domain requesting the access token. The domain name can be forged with a DNS hijack (or a virus affecting ...
2
votes
2answers
266 views

Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?

I came across a project called jCryption 3.0, which encrypts data between the client and server, without using SSL. If a website's JavaScript had used jCryption 3.0 to encrypt login form fields before ...
0
votes
1answer
98 views

Verify CDN javascript's integrity

CDNs speed up the loading of websites by allowing caching for frequently used javascript libraries like jquery. How do we know if they have modified the javascript before serving it to my clients? ...
3
votes
1answer
793 views

How to secure my REST implementation for an ember.js app

I've been searching and searching for what seems days and have not come up with any definitive answer on a solution to my problem. To explain without going into terrible detail I am building a store, ...
0
votes
1answer
22 views

Secure keyboard entry with JavaScript or Flash?

Is it possible to perform secure keyboard entry (similar to what is offered in the OS X Terminal app) using only web technologies and/or Flash? If not, is there any way to more broadly guarantee ...
0
votes
1answer
47 views

How can I secure my server to ensure pre-login calls are originating from my app?

I have a .NET Web Api servicing a Cordova based mobile app and web front end written in AngularJS. I have done a ton of research and most sources don't give a great answer or one that's huge overkill ...
0
votes
1answer
41 views

From a security perspective, why not a screenshot api for browser? [closed]

I mean a javascript api for capturing a renderered html page, or current viewport, and dump content onto an image. While there are obvious attacks, such as taking screenshot of sensitive information, ...
2
votes
2answers
172 views

Website infected with unwanted “redirections”, apparently via javascript code

I'm working on a clients website, and I realize they've been compromised. Early today there was a major problem with a php eval(base64_decode issue. That was cleaned up via Andy Stratton clean.php ...
9
votes
2answers
2k views

How do the Stack Exchange sites protect themselves from XSS? [duplicate]

It seems to me that because Users can post questions and comments in them with HTML markup (possibly <script> tags), Stack Exchange sites would be very exposed to XSS attacks. How do they ...
3
votes
1answer
67 views

How does the same-origin policy apply between browser tabs? [duplicate]

Let's assume that we have 2 open tabs in a browser containing page A (A.html, A.js) into the first tab and page B (B.html, B.js) into the second tab and that page A and B have the same origin (scheme, ...
1
vote
1answer
118 views

Encrypted quiz data in PHP and JS

I'm developing a quiz with which you can win a few cool prizes. Therefore I'm afraid, that someone might try to hack/manipulate it. All participants have to be logged in and the website takes 15 ...
2
votes
2answers
105 views

High level design for secure web application

I'm looking for some advise on designing a secure web app for storing passwords. Why reinvent the wheel? Because I don't trust a 3rd party with all of my passwords. Here are my thoughts: There are ...
8
votes
3answers
191 views

Preventing user supplied javascript from posting to external server

I am writing an internal tool that will support plugins written by other developers. Ideally, these plugins would have a Javascript component to allow people to make widgets. Some of the pages these ...
7
votes
2answers
17k views

Javascript and jQuery not secure over https

I am building an ASP.NET MVC 3 app which will run in Azure. Everything was working well, until I switched to https. Now most of my jQuery plugins and some other javascript are not secure. I'm using ...
13
votes
4answers
4k views

Generate cryptographically strong pseudorandom numbers in Javascript?

Is there any good way to generate cryptographically strong pseudorandom (or true random) numbers in Javascript? The crucial requirement: if a.com's Javascript generates some random numbers, no one ...
2
votes
1answer
84 views

How is the QSS tag used as payload in an XSS attack?

I have received a report from a client that lists XSS vulnerabilities. The report shows reflected XSS vulnerabilities. In each vulnerability, the payload reflected is a single, unclosed <qss> ...
0
votes
1answer
107 views

Preventing socket.join(“room”) client-side, listening for private room leaving

i'm developing an application with Socket.IO that needs to authenticate if user can join a room. Client side: var socket = io('http://<?php echo $_SERVER['HTTP_HOST'];?>:3000'); ...
2
votes
1answer
42 views

Spoofing of Server Sent Events

In the spec for Server Sent Events, it says Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, ...
1
vote
1answer
151 views

What are the security risks associated with PDF files?

What are the security risks associated with PDF files? There is, of course, the general risk associated with any type of file: that whatever application is used to read it will have a bug that can be ...
41
votes
4answers
12k views

Why is the same origin policy so important?

I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
-1
votes
2answers
102 views

Is JavaScript console vulnerable to XSS

Assume the content of the name variable below is controlled by an attacker. Is this line of code vulnerable to XSS? console.log(name) When I send an injection in name variable I see its value ...
4
votes
1answer
116 views

Suspecious js file sent as email attachment

I received a js file with following code in my spam folder but I decided to take a look into the file. Do anybody of you know what does this code might do? var evl='';function nr() { evl = '}; ' + ...
3
votes
5answers
8k views

Hiding JavaScript source code

In a web-app should one strive to hide as much of the code as possible, for example from view source? In particular I was wondering should JavaScript be hidden, especially ones used for Ajax? I was ...
23
votes
2answers
4k views

JavaScript written only with brackets?

I once saw JavaScript code which was only written as multiple brackets (). Does anybody remember this kind of code? There was also an online converter to convert "normal" JS into this style of code. I ...
5
votes
1answer
283 views

Exploit SoakSoak injected in Wordpress

I have recently received an attack to my website and Google is warning visitors to not load the page. The malware is located in wp-includes/js/swfobject.js of my Wordpress and I had deleted it but ...
49
votes
6answers
5k views

Does injecting querystring values directly into HTML pose a security risk?

Someone reported a bug on my site that I don't really consider an issue. My site has an URL akin to this: www.site.com/ajax/ads.asp?callback=[text injection] So filetype is application/json, and I ...
2
votes
2answers
8k views

XSS cookie stealing without redirecting to another page

I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another ...
4
votes
1answer
88 views

Should I be worried about this url request I received on my site?

I was checking the weekend logs of my IIS server and noticed a strange request which was blocked: ...
0
votes
2answers
98 views

How can this web server be compromised?

A linux server has Node.js installed with the http-server package. The server will respond to requests on port 80 with a file in the same directory named index.html. An interesting characteristic of ...
2
votes
2answers
9k views

Best Approach for removing XSS Vulnerability

I have been developing a Webobjects application, and I found that my application is vulnerable to XSS through URL, but not when malicious input like <script>alert("hi")</script> is input ...
2
votes
5answers
380 views

Is converting `<` to `&lt;` sufficient to prevent execution of JavaScript from arbitrary HTML?

This is kind of a bar-bet question. An acquaintance of mine has made the claim that, given an arbitrary glob of HTML, it can be completely prevented from executing JavaScript if, before slapping it ...
2
votes
2answers
108 views

is it sufficient to convert '(single-quote) to ` &#039; `

Is it sufficient to convert ' to &#039; , > converted to &gt; and < converted to &lt; to avoid xss A bit of context: the payload would be going through the URL and landing in a ...
4
votes
2answers
253 views

How can document.referrer be used for XSS?

A very simple example... <div id="cat"></div> <script> document.getElementById("cat").innerHTML = document.referrer; </script> or <script src="' + document.referrer + ...
16
votes
2answers
2k views

Can JavaScript be used to capture the user's screen?

Can JavaScript be used to capture the user’s screen? If so, is this functionality available in any JS framework? (I do not need code examples: I am mainly asking to form an opinion about the security ...
8
votes
2answers
968 views

Cordova/Phonegap: RefreshToken in localstorage

I am (partly) following a tutorial to develop a cordova app, based on angularJS. The author stores the refresh token in local storage, which was said to be very bad practice in one of the comments on ...
2
votes
3answers
1k views

Why are scripts injected through innerHTML not executed whilst onerror and other on<event> attributes on elements are? - Google XSS Challenge 2

SPOILER ALERT : Do not continue if you do not want to be spoiled I am currently doing the Google XSS Challenge Level 2 . I am injecting XSS code that is inserted into the document using ...
9
votes
4answers
2k views

My ISP is injecting strange codes to every website I visit

Here's the code at the bottom of every page: <script type="text/javascript">if(self==top){var idc_glo_url = (location.protocol=="https:" ? "https://" : "http://");var idc_glo_r = ...
0
votes
2answers
210 views

What's the best way to authenticate an user using a websocket?

I'm creating a multiplayer game(based in websockets) which runs directly from the browser and which has multiplayer functionality. Each player needs to have his own account(Username and password). ...
6
votes
5answers
5k views

Obfuscating JavaScript code

Some Flash developers are afraid of JavaScript. Their point of view: Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...