Hot answers tagged

111 votes
Accepted

Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?

From a security perspective, you need to revalidate everything on the server. This will always be the case, no matter how pretty and advanced HTML5 features become. You simply can not trust the client....
Anders's user avatar
  • 65.6k
90 votes

Security risks of user generated HTML?

User-defined HTML You're attempting to sanitize user input by blacklisting things you don't want to allow. Unfortunately, especially given the very large list of options for HTML5, it's quite easy to ...
Conor Mancone's user avatar
47 votes

How can html5 geolocalisation bypass my vpn?

I just checked this with my VPN in http://html5demos.com/geo Although I VPN through Germany, it still shows my nearby location in London. If you read https://www.mozilla.org/en-US/firefox/...
Iraklis's user avatar
  • 661
22 votes

Security risks of user generated HTML?

Currently these are the tags that are banned: In addition to what's already been posted, make sure that banning means "don't letting the user save the data", not "remove the banned stuff and save ...
Matsemann's user avatar
  • 318
21 votes

How can html5 geolocalisation bypass my vpn?

A VPN masks your IP address. But the HTML5 geolocation API isn't based on your IP address. It is a Javascript API which can be used to ask the web browser directly where it thinks it is located ...
Philipp's user avatar
  • 49.4k
16 votes

Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?

An explanation with code and screenshots The answers given are great. But I wanted to illustrate this with some code/screenshots. The bottom line is that anything client side can be manipulated (...
Andy's user avatar
  • 320
13 votes

How can html5 geolocalisation bypass my vpn?

Try disabling HTML5 geolocation if you don't use it. In Firefox, set geo.enabled to false in about:config. There have been bugs, and there will be again, example 1 and example 2.
Shautieh's user avatar
  • 238
10 votes
Accepted

Passing PHP code directly into JavaScript in HTML5

JSON_HEX_TAG If you are echoing into JS inside a HTML document (as you are in your example), this is necesarry or you risk opening up a huge XSS vulnerability. Without this one, an attacker can post ...
Anders's user avatar
  • 65.6k
9 votes
Accepted

Why is a "tainted canvas" a risk?

What exactly would that image request URL look like? It need not be anything complicated or abnormal. There are two main ways this could work (were it not for the restrictions in the browser): In ...
Anders's user avatar
  • 65.6k
9 votes
Accepted

Browser exploits based purely on HTML + CSS

Yes, in the past there have been lots of exploits that only relied on malicious HTML and CSS code. You are right in that parsing a complex, turing-complete language is potentially more error-prone, ...
Arminius's user avatar
  • 44.8k
9 votes

Protecting against input type ="password" changes?

Well, you can do it using the MutationObserver API. const inputPasswordElements = document.querySelectorAll('input[type=password]'); const observer = new MutationObserver(function (mutations) { ...
Benoit Esnard's user avatar
7 votes
Accepted

Why is sub resource integrity (SRI) only limited to certain files?

Why is it limited to JS and CSS resources? But, why is it only limited to JS and CSS files? The W3C SRI specification states: The scheme specified here also applies to link and future versions ...
Ronny's user avatar
  • 1,088
6 votes

Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?

As Anders stated, client-side validation is irrelevant for the security of the application, but very important from the UX point of view. Client-Side validation is focused o providing the user a ...
Bristran's user avatar
  • 121
6 votes
Accepted

Is using enctype="multipart/form-data" always a bad idea?

Using enctype="multipart/form-data" creates both a binary and an ascii upload I consider this statement wrong. There is application/x-www-form-urlencoded where the body of the POST request consists ...
Steffen Ullrich's user avatar
6 votes

Preventing CSRF attacks against WebSocket communications

A CSRF attack on WebSocket is possible, if you rely on authentication cookies. From RFC 6455 §1.3: The |Origin| header field [RFC6454] is used to protect against unauthorized cross-origin use of a ...
Daniel's user avatar
  • 677
6 votes

Security risks of user generated HTML?

Leaving aside all the ways I could still slip XSS past this blacklist (which other answers have largely covered), allowing arbitrary HTML is still very dangerous. For example, if the user has control ...
CBHacking's user avatar
  • 48.2k
5 votes

Alternatives to HTML's deprecated <keygen> for client certs?

The WebCrypto API is currently not an alternative for the keygen tag, as confirmed by the WebCrypto API spec: This API, while allowing applications to generate, retrieve, and manipulate keying ...
Graham Leggett's user avatar
5 votes

Security risks of user generated HTML?

There are major risks with user generated content that is to be interpreted/parsed and displayed publicly. XSS attacks and the like can occur from users being able to sneak tags through your ...
Jarrod Christman's user avatar
4 votes

Is HTML5 sessionStorage secure for temporarily storing a cryptographic key?

Apparently the sessionStorage is not really cleared when closing the tab. It is easily revived by clicking on "Reopen closed tab" I've written more about it in here: http://blog.guya.net/2015/08/25/...
guya's user avatar
  • 141
4 votes

Alternatives to HTML's deprecated <keygen> for client certs?

In case you already have a <keygen>-based setup and want to keep using it, I created a project which attempts to implement a JavaScript polyfill for <keygen>: https://github.com/...
Vladimir Panteleev's user avatar
4 votes

How to Pass Authorization Header in HTTP Request when using HTML5 Player (Audio tag) for security

You cannot add any custom headers this way. The established way to add user specific authorization is to have a session cookie. If such a cookie is set for the target URL (i.e. the user is already ...
Steffen Ullrich's user avatar
3 votes

Is HTML5 vibrate feature a security vulnerability?

It's not a vulnerability in and of itself as it cannot be used to directly exploit the device, but it certainly can be and (as your question indicates) has been used for social engineering attacks. ...
bwDraco's user avatar
  • 473
3 votes
Accepted

Is there a way to use clear key encryption for protecting media HTML5 media streams?

The point of EME with clear key encryption is to provide an easier to implement encryption for content that is slightly more difficult to steal and share. If you really need to protect your content, ...
Mike Grace's user avatar
3 votes

Is it secure to share an access token via HTML5 messaging API between various iframes?

The postMessage API is designed for cross domain communication as part of the Cross Origin Resource Sharing mechanism. The Window.postMessage() method, introduced in HTML5, allows JavaScript code ...
Shurmajee's user avatar
  • 7,457
2 votes

Can canvas fingerprinting be prevented?

Panopticlick is looking for things that make you different to other visitors. In this case, fewer people use canvas blockers than don't, so you become more unique if you use one. However, this only ...
Matthew's user avatar
  • 27.4k
2 votes

Malware through HTML 5 player

There are no known public sandbox escapes for the latest version of Chrome so this would require a Chrome 0-day. This means that while it is not impossible it is very unlikely that a particular person ...
Zeta Two's user avatar
  • 446
2 votes

How to Pass Authorization Header in HTTP Request when using HTML5 Player (Audio tag) for security

You can use fetch: <audio controls> <source id="my-audio" type="audio/mp3" /> </audio> var url = "https://storage.googleapis.com/media-session/sintel/...
Eduardo Cuomo's user avatar
2 votes

JWT authentication or cookies?

Reasons to pick JWT: Does not require the server to keep a state, i.e. no need for costy lookup on every request. Easier to share authorisation across different domains. Reasons to pick session ...
Anders's user avatar
  • 65.6k
2 votes

Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?

None of the answers so far really mention it, so let me add this: The reason why anything in your HTML is completely irrelevant for security is that any attacker can, trivially, create requests ...
AnoE's user avatar
  • 2,389

Only top scored, non community-wiki answers of a minimum length are eligible