New answers tagged

0

Yes, this can be a Direct Object Reference exploit, or even XSS injection. Here's an example. Let's say your jQuery ajax does the following: DeleteUserById(100); What happens if you edit this value through the use of a Firefox plugin such as TamperData, or editing it via the developer console? DeleteUserById(1); You deleted the first user instead. ...


1

Someone doesn't even need to modify the JavaScript - they could just make a request directly to the API in their web browser. Most sites that restrict APIs do it by having some form of authentication - this might be a header which the script sets containing a value that has previously been provided by the API. Even then, though, other scripts could call the ...


4

You can't rely on any protection from changes in client side code, you can only do your best to prevent them (ie XSS and CSRF). Anyone can run arbitrary JavaScript code on a page as if it were run by that page itself. Edit: As an example, if you're using a modern desktop browser such as Chrome, right-click anywhere on this current page then click on the ...



Top 50 recent answers are included