Timeline for What are the security risks of letting the users upload content to my site?
Current License: CC BY-SA 2.5
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 14, 2014 at 23:05 | comment | added | Søren Løvborg | A fourth risk, severe yet easy to miss: Upload of client-side active content, such as JavaScript (including HTML/CSS with embedded JavaScript), Java applets, Flash objects, etc., all of which can be used to perform cookie-stealing attacks and work around same-origin policies. Your website might think the user uploaded a GIF image, when it's really a Java JAR. Always host user uploads on a separate domain, cf. googleusercontent.com, upload.wikimedia.org, etc. | |
| Nov 21, 2010 at 13:40 | comment | added | AviD♦ | Also, potential of flooding your server, thus causing DoS. | |
| Nov 19, 2010 at 22:00 | vote | accept | Edgar | ||
| Nov 19, 2010 at 8:51 | history | answered | Rory McCune | CC BY-SA 2.5 |