Tag Info

New answers tagged


I see two possible attack vectors. eavesdropping cross site scripting vulnerabilities in your web application When the token isn't transmitted via HTTPS, it can be intercepted and used by an eavesdropper. To prevent this, enforce https for all communication. When the HTML document includes any data from a 3rd party, you need to be weary of XSS ...

Top 50 recent answers are included