0

What if the majority of the page is served via SSL properly (HTTPS) but there's some stray javascript file that is served unencryped (HTTP)?

What's the risk here? Thanks

  • While not necessarily a duplicate, you might find this answer helpful. – RoraΖ Jan 6 '16 at 17:24
  • that is a question, not an answer :) you forgot the #anchor? ;) – knocte Jan 7 '16 at 2:19
2

If someone can inject my JavaScript code into the page, for instance by hijacking an unsecured connection, then they can basically take control of entire page.

For instance, let's say you're trying to log in to That Website That Stores All Of Your Personal Information™, but one of the JavaScript files is served over an insecure connection. A rogue employee at your ISP intercepts this one connection, and injects JavaScript code that, when you click the "Log In" button, takes the username and password you entered and sends it to himself. Now he has control over your login information and can potentially steal your identity, based on the information that he can find on your account page (such as full name, address, phone number, last four digits of your credit card number etc.)

| improve this answer | |
0

You can get served by a malicious javascript file pretending to be yours - via a man in the middle attack. From there the file may run code that will attack your user: e.g. request the user's password (pretending a re-login request) and send it to another place. And there are more example's.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.