221 reputation
111
bio website knaddison.com
location United States
age
visits member for 2 years, 9 months
seen Dec 1 at 17:49

I'm part of the team at CARD.com where I help make our websites and IT operations as smooth and powerful as I can.

In the Drupal world I'm active as the Drupal Security Team lead, a module maintainer, meetup and Drupalcamp co-organizer.


Sep
24
awarded  Autobiographer
Sep
20
awarded  Popular Question
May
1
comment XSS via PDF when Content-Disposition: Inline?
Thanks for your answer. I'm hopeful to get a bit more details about the nature and exposure of the issue so I'm not going to accept this answer just yet.
Apr
30
asked XSS via PDF when Content-Disposition: Inline?
Feb
18
comment Is $_SERVER[ ] a safe source of data in PHP?
Or rather, what specific data types can it contain. AFAIU, they can be either strings or arrays, but not bools nor objects nor ints. This is important because 3v4l.org/vhNTG
Feb
17
comment Is $_SERVER[ ] a safe source of data in PHP?
This talks about controlling the variables, but there are two important and distinct elements of the variables: their content and their data type. Can you clarify if you believe it's possible for a client to set the data type of any of these to anything other than a string?
Feb
14
awarded  Popular Question
Jul
27
awarded  Nice Question
Jul
27
awarded  Yearling
Jul
24
awarded  Informed
Jul
24
accepted Sending HTTP 403 as. 200 - “Silent Identification of Admin”
Jul
23
comment Sending HTTP 403 as. 200 - “Silent Identification of Admin”
I just updated the question - cookies on the site are httponly and secure and the site uses ssl and hsts. I can't really say what the "right" behavior is, but I can say that in my testing that this attack (disclosing information) still works in Chrome and Firefox latest.
Jul
23
revised Sending HTTP 403 as. 200 - “Silent Identification of Admin”
clarifying the scenario based on the comments/answers
Jul
23
comment Sending HTTP 403 as. 200 - “Silent Identification of Admin”
I think the same origin policy would prevent scanning the html content. I'm not sure I follow the double-negative in your comment about secure and httponly flags on cookies. Can you elaborate on that?
Jul
22
comment Sending HTTP 403 as. 200 - “Silent Identification of Admin”
No problem at all. Your very appropriate use of headers let me skim to the part I cared about ;)
Jul
22
comment Sending HTTP 403 as. 200 - “Silent Identification of Admin”
And thanks for the great answer.
Jul
22
comment Sending HTTP 403 as. 200 - “Silent Identification of Admin”
You said "The Javascript which triggers the loading can look at the code but also at the page." but I thought the Same Origin Policy prevents the javascript from looking at the page. Can you expand on how the script could read the page?
Jul
22
awarded  Commentator
Jul
22
comment Sending HTTP 403 as. 200 - “Silent Identification of Admin”
Yes, I'm familiar with response code purposes ;) The last paragraph is solid advice. Thanks for it.
Jul
22
comment Sending HTTP 403 as. 200 - “Silent Identification of Admin”
I think you've misunderstood the scenario (and/or I explained it poorly). There's no credentials involved. It's about javascript on a 3rd party site that can detect whether a user's browser has an active session on the site that is authenticated as an admin.