111
votes
Accepted
Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?
From a security perspective, you need to revalidate everything on the server. This will always be the case, no matter how pretty and advanced HTML5 features become. You simply can not trust the client....
90
votes
Security risks of user generated HTML?
User-defined HTML
You're attempting to sanitize user input by blacklisting things you don't want to allow. Unfortunately, especially given the very large list of options for HTML5, it's quite easy to ...
47
votes
How can html5 geolocalisation bypass my vpn?
I just checked this with my VPN in http://html5demos.com/geo
Although I VPN through Germany, it still shows my nearby location in London.
If you read https://www.mozilla.org/en-US/firefox/...
22
votes
Security risks of user generated HTML?
Currently these are the tags that are banned:
In addition to what's already been posted, make sure that banning means "don't letting the user save the data", not "remove the banned stuff and save ...
21
votes
How can html5 geolocalisation bypass my vpn?
A VPN masks your IP address. But the HTML5 geolocation API isn't based on your IP address. It is a Javascript API which can be used to ask the web browser directly where it thinks it is located ...
16
votes
Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?
An explanation with code and screenshots
The answers given are great. But I wanted to illustrate this with some code/screenshots.
The bottom line is that anything client side can be manipulated (...
13
votes
How can html5 geolocalisation bypass my vpn?
Try disabling HTML5 geolocation if you don't use it. In Firefox, set geo.enabled to false in about:config.
There have been bugs, and there will be again, example 1 and example 2.
10
votes
Accepted
Passing PHP code directly into JavaScript in HTML5
JSON_HEX_TAG
If you are echoing into JS inside a HTML document (as you are in your example), this is necesarry or you risk opening up a huge XSS vulnerability. Without this one, an attacker can post ...
9
votes
Accepted
Why is a "tainted canvas" a risk?
What exactly would that image request URL look like?
It need not be anything complicated or abnormal. There are two main ways this could work (were it not for the restrictions in the browser):
In ...
9
votes
Accepted
Browser exploits based purely on HTML + CSS
Yes, in the past there have been lots of exploits that only relied on malicious HTML and CSS code.
You are right in that parsing a complex, turing-complete language is potentially more error-prone, ...
9
votes
Protecting against input type ="password" changes?
Well, you can do it using the MutationObserver API.
const inputPasswordElements = document.querySelectorAll('input[type=password]');
const observer = new MutationObserver(function (mutations) {
...
7
votes
Accepted
Why is sub resource integrity (SRI) only limited to certain files?
Why is it limited to JS and CSS resources?
But, why is it only limited to JS and CSS files?
The W3C SRI specification states:
The scheme specified here also applies to link and future versions ...
6
votes
Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?
As Anders stated, client-side validation is irrelevant for the security of the application, but very important from the UX point of view.
Client-Side validation is focused o providing the user a ...
6
votes
Accepted
Is using enctype="multipart/form-data" always a bad idea?
Using enctype="multipart/form-data" creates both a binary and an ascii upload
I consider this statement wrong. There is application/x-www-form-urlencoded where the body of the POST request consists ...
6
votes
Preventing CSRF attacks against WebSocket communications
A CSRF attack on WebSocket is possible, if you rely on authentication cookies. From RFC 6455 §1.3:
The |Origin| header field [RFC6454] is used to protect against unauthorized cross-origin use of a ...
6
votes
Security risks of user generated HTML?
Leaving aside all the ways I could still slip XSS past this blacklist (which other answers have largely covered), allowing arbitrary HTML is still very dangerous. For example, if the user has control ...
5
votes
Alternatives to HTML's deprecated <keygen> for client certs?
The WebCrypto API is currently not an alternative for the keygen tag, as confirmed by the WebCrypto API spec:
This API, while allowing applications to generate, retrieve, and manipulate keying ...
5
votes
Security risks of user generated HTML?
There are major risks with user generated content that is to be interpreted/parsed and displayed publicly. XSS attacks and the like can occur from users being able to sneak tags through your ...
4
votes
Is HTML5 sessionStorage secure for temporarily storing a cryptographic key?
Apparently the sessionStorage is not really cleared when closing the tab. It is easily revived by clicking on "Reopen closed tab"
I've written more about it in here:
http://blog.guya.net/2015/08/25/...
4
votes
Alternatives to HTML's deprecated <keygen> for client certs?
In case you already have a <keygen>-based setup and want to keep using it, I created a project which attempts to implement a JavaScript polyfill for <keygen>:
https://github.com/...
4
votes
How to Pass Authorization Header in HTTP Request when using HTML5 Player (Audio tag) for security
You cannot add any custom headers this way.
The established way to add user specific authorization is to have a session cookie. If such a cookie is set for the target URL (i.e. the user is already ...
3
votes
Is HTML5 vibrate feature a security vulnerability?
It's not a vulnerability in and of itself as it cannot be used to directly exploit the device, but it certainly can be and (as your question indicates) has been used for social engineering attacks.
...
3
votes
Accepted
Is there a way to use clear key encryption for protecting media HTML5 media streams?
The point of EME with clear key encryption is to provide an easier to implement encryption for content that is slightly more difficult to steal and share. If you really need to protect your content, ...
3
votes
Is it secure to share an access token via HTML5 messaging API between various iframes?
The postMessage API is designed for cross domain communication as part of the Cross Origin Resource Sharing mechanism.
The Window.postMessage() method, introduced in HTML5, allows JavaScript code ...
2
votes
Can canvas fingerprinting be prevented?
Panopticlick is looking for things that make you different to other visitors. In this case, fewer people use canvas blockers than don't, so you become more unique if you use one. However, this only ...
2
votes
Malware through HTML 5 player
There are no known public sandbox escapes for the latest version of Chrome so this would require a Chrome 0-day. This means that while it is not impossible it is very unlikely that a particular person ...
2
votes
How to Pass Authorization Header in HTTP Request when using HTML5 Player (Audio tag) for security
You can use fetch:
<audio controls>
<source id="my-audio" type="audio/mp3" />
</audio>
var url =
"https://storage.googleapis.com/media-session/sintel/...
2
votes
JWT authentication or cookies?
Reasons to pick JWT:
Does not require the server to keep a state, i.e. no need for costy lookup on every request.
Easier to share authorisation across different domains.
Reasons to pick session ...
2
votes
Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?
None of the answers so far really mention it, so let me add this:
The reason why anything in your HTML is completely irrelevant for security is that any attacker can, trivially, create requests ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
html-5 × 55javascript × 15
web-application × 13
web-browser × 13
html × 12
encryption × 4
appsec × 4
cookies × 4
websocket × 4
tls × 3
certificates × 3
php × 3
xss × 3
session-management × 3
client-side × 3
same-origin-policy × 3
fingerprinting × 3
css × 3
authentication × 2
passwords × 2
privacy × 2
public-key-infrastructure × 2
mobile × 2
key-management × 2
csrf × 2