The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

3
votes
2answers
94 views

Limiting latter dom-based XSS when setting document.title

Given some JavaScript which modifies the page's title by taking in variable data document.title = someVariable I am looking to address dom based XSS while keeping the title fairly readable. ...
2
votes
2answers
184 views

Attack using weird characters followed by some javascript in a URL?

I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this: /js/bundles/,!0):this.element.propAttr( ...
4
votes
1answer
105 views

Can source javascript files be infected from a developer's machine?

First a little bit of background, About two weeks back one of the developers in my team said they were seeing advertisement popups and links appearing all over the web app we were developing, when ...
3
votes
1answer
106 views

Securely identify clients by web app

I have a web service S that provides certain services. There are two web apps, A1 and A2, both on different servers within the same VPN, which I trust and want to grant access to my web service. ...
3
votes
1answer
1k views

How to secure my REST implementation for an ember.js app

I've been searching and searching for what seems days and have not come up with any definitive answer on a solution to my problem. To explain without going into terrible detail I am building a store, ...
2
votes
1answer
66 views

What are the best practices for (token based) security in a webapp?

I am designing a web application using Spring MVC with REST controllers and Angular JS pages which communicate with these REST controllers. I've implemented a token based security/ authorization ...
1
vote
1answer
92 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = ...
2
votes
0answers
52 views

How to indicate that content in an iframe is untrusted

As part of a website I am developing, untrusted content is displayed in a sandboxed iframe. The content is loaded using the srcdoc attribute, but the iframe is sandboxed using sandbox="allow-scripts", ...
2
votes
0answers
73 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
2
votes
0answers
108 views

How does JavaScript Injection work?

I was watching a DefCon talk and the speaker was saying he was able to infect JavaScript cache files, once the user visited his website/server. From there he was able to load scripts from other sites ...
2
votes
0answers
66 views

Securing a JavaScript app with RESTful backend

I went through the question Securing a JavaScript Single Page App with RESTful backend that has discussions / options around securing a Javascript client side app that invokes RESTful APIs. However, ...
1
vote
0answers
68 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. ...
1
vote
0answers
140 views

XSS Vectors for new Image()

What are possible XSS vectors to this JavaScript code new Image().src = encodeURI('[user url here]'); Let's assume two cases: [user url here] is some string provided by user (with no validation) ...
1
vote
0answers
109 views

Hacking attempts:in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an "in.js" file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
0
votes
0answers
48 views

injecting javascript in webviews in Android

I am relatively new to mobile application security. Currently I am supposed to audit an android application which uses a webview to display some static FAQ page in an activity. The webview in ...
0
votes
0answers
67 views

Problem in 'underscore.js' “new Function()” when CSP header is set.

In underscore.js, template rendering causes violation of the 'unsafe-eval' property, with CSP error at following line: "render = new Function(settings.variable || 'obj', '_', source);" The solution ...
0
votes
0answers
49 views

Securing REST API with HMAC and SPA

I'm developing a JS based SPA and the backend is a rest api which uses HMAC. The site/app doesn't have the concept of registered users but it has the concept of session. How do i make sure that the ...
0
votes
0answers
216 views

Best practices to invalidate JWT while changing passwords and logout in node.js?

I would like to know the best practices to invalidate JWT without hitting db while changing password/logout. I have the idea below to handle above 2 cases by hitting the user database. 1.Incase of ...
0
votes
0answers
83 views

Securing my API: concept of access tokens

First of all I want to excuse for the bad spelling and grammar. English is not my mother tongue. I have built a JSON communication between a front-end (website) and my Node.js web server. I want to ...