So, we've got a fairly standard login page on a web application.
We want to make a slight change so that if a user gets their password wrong, the page reloads (as it currently does) but the username is kept so the user doesn't need to enter it again.
The easiest way for us to do this is just put the username in the querystring, and bind that to the username input.
Are there any risks associated with this approach?
I've been thinking it through, and I can't think of how it could be exploited (except for a modified URL being sent to users that prepopulate with a different user's username, but even still, I can't see how that could be exploited further).
"><script>mineCryptoCoins()</script>
to a third party? Do you correctly escape the input? If so, not a problem, else you could end up with a reflected XSS issue (although probably only in old browsers)value=""
attribute of the input, I would be very surprised if ASP.NET didn't have a way to do this. I'm not too familiar with ASP.NET, but this may still be relevant, otherwise I'm sure more info could be found by searching.localStorage
?