Tag Info

New answers tagged

0

This issue was specific in nature, and has since been patched out of Ruby. Flash was more of an example of how one can exploit this issue with a browser plugin, a good example too given it's probably one of the most common plugins, but the actual flaw was in Ruby. We are also talking way edge case that an attacker could pull this off. There is really ...


3

The issue is that the code sample in the OWASP guide is not complete. Specifically, it is missing the implementation of the master_Page_PreLoad method that it wires up in the last line of the Page_Init method. What you would see, if that method were included (and I may go add it shortly here) is that the ViewStateUserKey value being set by the cookie is ...


0

Please keep in mind though, that while cookies and sessions can be accessed from all your pages on your website, ViewState values are not carried between pages, they carry values between postbacks: If your Web site authenticates users, you can set the ViewStateUserKey property in the Page_Init event handler to associate the page's view state with a specific ...



Top 50 recent answers are included