Timeline for Understanding POST based XSS
Current License: CC BY-SA 4.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 13, 2019 at 17:04 | comment | added | Buffalo5ix |
To clarify, SOP prevents you from reading responses from another website. POST requests get through fine, with some caveats. HTML forms don't have access to the response, and therefore get through fine. My JS knowledge isn't great, so I'm not sure what fetch uses behind the scenes, but something like xmlhttprequest won't work because that library has access to the response which triggers standard SOP checks. In other words, a simple redirect bypasses SOP, but any function that tries to retrieve the response will have to deal with SOP validation.
|
|
| Aug 13, 2019 at 16:52 | comment | added | Benoit Esnard | @bobjohn43: you would do a XSS attack since you most likely want to run JS on the target site, not on yours. Same-origin policy prevents you to read / post data on another website. | |
| Aug 13, 2019 at 16:49 | comment | added | bobjohn43 | Thank you for your answer, but I have a question for the last part of your answer, the Fetch part. If a user is already on my website, why would I need to do an XSS post attack? I can execute my own JS there and attack the user. | |
| Aug 13, 2019 at 16:38 | history | answered | Benoit Esnard | CC BY-SA 4.0 |