0
votes
1answer
51 views

Understanding Same origin policy

I am trying to understand same origin policy better. From what I understand same origin policy restricts code from one "origin" not access data from another "origin". What I am trying to understand is ...
1
vote
1answer
66 views

CSRF Token Stealing

I came across this link that dicusses how an attacker could exploit access control allow origin to get an anti-CSRF token: ...
2
votes
3answers
388 views

Flash ignores Content-Type header, allowing XSS?

I recently read that the Flash plugin ignores the Content-Type header in certain circumstances. In particular, you can give Flash a URL, and the Flash plugin will happily fetch the content at that ...
7
votes
2answers
351 views

Best practices for integrating external javascript?

I'm looking for some standard pieces of advice on how to integrate external JavaScript into a website. For example, on mywebsite.com: <script ...
8
votes
3answers
335 views

E-mail read receipt through XSS

I recently stumbled upon a really silly/unsafe but an interesting way to get a read receipt of an e-mail. I'm not 100% sure if the method in use works, which is why I'm asking it here. G-mail does ...
3
votes
3answers
2k views

Why doesn't the same origin policy block get requests what contain arguments?

From what I understand, the same origin policy prevents scripts in a web page from talking to servers outside of the present domain (using post, xmlhttprequest, etc). I assumed that get requests ...