All Questions
Tagged with chrome web-application
14 questions
0
votes
0
answers
20
views
Store login credentials securely with JavaScript [duplicate]
Today I have a web application that needs to store the user's email and password, so that when he opens the login screen, the authentication is done automatically.
For this, our application saves the ...
- 174
9
votes
2
answers
27k
views
Chrome allow insecure localhost
I have just stumbled upon what is a very helpful flag in chrome (for developers):
chrome://flags/#allow-insecure-localhost
The flag is described as:
Allow invalid certificates for resources loaded ...
- 195
6
votes
2
answers
2k
views
Can a web app fingerprint your device as identical to a native app's fingeprint
I have installed an app on Android and my account got shadowbanned. I sniffed out the traffic with fiddler and see they use a analytics service that assigns your device a fingerprint.
I tried the web ...
- 227
1
vote
2
answers
975
views
Is chrome's prediction service for faster page loading vulnerable to attacks? is it safe to leave it on?
Chrome offers a "prediction service" for faster page loading. It might load some links on a page before you even click on them:
Use a prediction service to load pages more quickly: Browsers use an
...
- 507
6
votes
1
answer
921
views
Inspecting code elements in browser when logging in
When I use the built-in Chrome inspect element, click on the networking tab and view a login.action file or session file, it shows the password in plain text. Is this normal?
- 345
3
votes
1
answer
382
views
How to Send Decoded URI?
I'm working in Burp and received an interesting response when sending a decoded string as a GET request. Copying/pasting the same string into a browser, the string is automatically encoded by the ...
- 33
3
votes
2
answers
1k
views
Does Chrome respect the X-DNS-Prefetch-Control header?
If my web page returns X-DNS-Prefetch-Control=off, will Chrome do DNS prefetch for links like these?:
<link rel="dns-prefetch" href="http://www.spreadfirefox.com/">
I know Firefox and Chromium ...
- 139
6
votes
1
answer
906
views
Chrome is storing login POST requests in its memory
I am logging in to my site using Chrome (on Ubuntu). Even if I logout and close my browser I can see the login POST request content (containing username and Password) using "Hexedit".
I have seen a ...
0
votes
1
answer
360
views
Secure touch kiosk system without updates?
We have a discussion here, if an internet enabled kiosk system can be set up securely without updating the system regularly.
The facts in short:
We are developing a new software product which offers a ...
- 3
16
votes
1
answer
546
views
Preventing a site from appearing in the 'Most Visited' or 'speed dial' section of a web browser
Are there any established ways of preventing a website from appearing as an icon on the 'Most Visited' / 'Speed dial' / start page of a web browser?
One example of this is the tab that opens by ...
- 602
3
votes
1
answer
463
views
Getting a certificate warning for one email but not another
When I log into outlook.com using Chrome browser, I get a certificate warning for one account but not another. One says my connection is private, the other says it "may not be private".
Here are the ...
- 133
10
votes
1
answer
3k
views
How do I securely embed an <img> tag using a user-given URL?
If I hypothetically wanted to allow users to use an avatar from an arbitrary URL like this:
<img class="avatar" src="{user input}" />
There are many problems that I can think of:
There are ...
- 203
3
votes
2
answers
9k
views
What causes "High Risk Website Blocked" on Chrome?
I have a website with no ads and no external content. Everything on the page comes from the webserver in question. Some users on Google Chrome have reported that they see the following warning when ...
- 133
4
votes
4
answers
2k
views
What XSS attacks doesn't "Reflective XSS Protection" defeat?
Its been quite a while since I have played with cross site scripting vulnerabilities but today I came across a website today that was crying out to be tested for a basic XSS vulnerability.
So ...
- 2,782