The tag has no usage guidance.

learn more… | top users | synonyms

6
votes
2answers
350 views

XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?

Recently working on a Rails-based web application for a company, I had to look into XSS vulnerability. It turns out that the application, in some places, could take an HTML tag (e.g., jscodehere ...
3
votes
2answers
2k views

Is my current method of handling session cookies insecure?

I'm writing a multi-tenant application where accounts are scoped by subdomains. This adds considerable complexity and I'm starting to worry about security. Each user can have several accounts. For ...
5
votes
3answers
1k views

How can I defend against malicious GET requests?

My server is getting hit with a variety if requests like the following: Started GET "/key/values" ActionController::RoutingError (No route matches [GET] "/key/values") Started GET "/loaded" ...