Questions tagged [html-5]
HTML5 is a markup language used for structuring and presenting content on the World Wide Web.
55
questions
3
votes
1
answer
378
views
What security concerns are there for a fully client-side JS/HTML5 app?
I'm working on an Interactive Fiction story in Undum, which is a fully client-side JS/HTML5 framework. I've been reading about Content Security Policy lately (after looking up what a crypto nonce is) ...
- 133
41
votes
7
answers
10k
views
Security risks of user generated HTML?
I am creating a website that allows people to upload HTML content.
Currently these are the tags that are banned:
<script></script>
<iframe>
<object>
<embed>
<style&...
- 511
3
votes
1
answer
1k
views
Can a javascript on parent page log keystrokes inside an iframe?
I am trying to analyze the possibility of accessing keystrokes from an iframe using a javascript running on the parent page. The potential attack which I am looking to verify is Cross Frame Scripting.
...
- 3,921
1
vote
1
answer
376
views
Stealing page source via Clickjacking [closed]
I am learning Javascript. Also researching web based vulnerabilitys to learn. I just wondering how Javascript can be used to steal view page source or any text or any tokens leaking on the page via ...
- 11
2
votes
2
answers
136
views
Do interactive ads on Android pose a security risk?
I have recently started seeing interactive ads in free applications I use on Android. I'm used to ads that come in the form of images, gifs or videos. Now, a lightweight, seemingly HTML5-compatible ...
- 147
3
votes
1
answer
138
views
What data related to a specific web page can be obtained outside the browser?
The browser has several built-in storages, such as local storage or indexedDB. Does it make sense to store sensitive data in them if there is a risk that some malware can access the browser's data ...
- 33
1
vote
1
answer
455
views
Are the details about the Widevine bug now public?
There was a bug in Widevine last year which enabled downloading Encrypted Media Extension Content.
They stated that they would give full details after 90 days. Was this meant for public disclosure or ...
- 1,462
-5
votes
1
answer
3k
views
Protecting against input type ="password" changes? [closed]
Are there any protections against users using Chrome Developer Tools to right click on a password input field, and then change input type="pass" to "text" to reveal the password?
There are probably ...
- 715
11
votes
1
answer
1k
views
Why is a "tainted canvas" a risk?
I understand the concern about a tainted canvas - the idea that the bits of an image from another site can be sent back to a malicious server. But can you explain the details of how exactly this works?...
- 215
0
votes
1
answer
6k
views
Is using enctype="multipart/form-data" always a bad idea?
If the form doesn't have any file upload, you just use enctype="multipart/form-data" everywhere, is it a bad idea from a security point of view?
Here someone says, in 2007
Uusing enctype="...
- 185
8
votes
2
answers
25k
views
How to Pass Authorization Header in HTTP Request when using HTML5 Player (Audio tag) for security
i am using HTML5 audio player as follows :
<audio controls>
<source src="<url>" type="audio/mp3">
</audio>
Now , i want to secure my app , So i want to pass some sessionId ...
- 213
9
votes
1
answer
3k
views
Passing PHP code directly into JavaScript in HTML5
I want to pass a PHP string directly to a JavaScript variable and keep the load on the server to a minimum. I have the following JavaScript in an PHP file for doing this:
<!DOCTYPE html>
<...
- 225
0
votes
2
answers
1k
views
JWT authentication or cookies?
I am currently creating a login system for my website. To secure the login service, should I use JSON Web Tokens and HTML5 storage, or should I use use the older way of using cookies? Are any of ...
- 1,187
24
votes
5
answers
11k
views
Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?
An interesting feature of HTML5 is the <input pattern="" /> attribute, which allows the browser to validate the input field's value against a regular expression provided by the developer.
...
- 815
-1
votes
1
answer
152
views
Vulnerabilities in PHP Form Handling Script [closed]
I'm writing a PHP script that takes input from an HTML5 form, including uploads, and emails them to an administrator using Magento's mail client. I think I've covered the basics pretty well, but I'm ...
- 101
1
vote
0
answers
2k
views
PWA/HTML5 recognized encrypted storage on desktop/mobile browser
Trying to find if there are recognized ways to handle Progressive Web Apps (PWA)/HTML5 type apps on desktop browsers (chrome, firefox) with some form of encrypted local storage that is sufficiently ...
- 131
9
votes
1
answer
2k
views
Why is sub resource integrity (SRI) only limited to certain files?
I'm quite enthusiastic about the Sub resource integrity (SRI) features. But, why is it only limited to JS and CSS files? I tried to pin a LESS (CSS variant) file, of which the integrity tag was ...
- 6,661
5
votes
1
answer
216
views
Malware through HTML 5 player
Just curious if it is possible to get malware through a trusted site hosting an HTML 5 player.
I would imagine since Chrome is in a sandbox, nothing download to your computer?
- 239
9
votes
2
answers
6k
views
Is it secure to share an access token via HTML5 messaging API between various iframes?
I have a main website that embeds 3 other websites via iframes (legacy systems providing various functionalities with a user interface). Currently the user has to authenticate with each of the system ...
- 439
2
votes
1
answer
541
views
How to securely access web api from Html5 Website
So the thing is I have created a Asp.Net web api and am using oauth to secure the access.
The problem is that the clients want to make a pure html(angular) website from which they will access the api. ...
- 121
46
votes
4
answers
10k
views
How can html5 geolocalisation bypass my vpn?
About two months ago I've decided to use a VPN all the time (it's launched at startup) for various reasons, privacy being the first one. But recently I realized that if you agree to share your ...
- 461
6
votes
1
answer
3k
views
Is there a way to use clear key encryption for protecting media HTML5 media streams?
I am trying to understand EME with Clear Key encryption. I am using MP4Box. From the documentation here, you specify decryption keys in an XML file that is used to encrypt/decrypt your mp4 files.
...
- 163
6
votes
1
answer
5k
views
Browser exploits based purely on HTML + CSS
In 2011, Eli Fox-Epstein demonstrated a Rule 110 machine in HTML + CSS3.
This led some to say that the combination of HTML + CSS3 is Turing complete.
Regardless of whether HTML + CSS3 is technically ...
- 2,031
4
votes
1
answer
282
views
How secure will EME be?
EME is a technology to allow proprietary code to be run in browser to frustrate piracy.
What are the security implications of this? Will it have full access to my computer (like the good-ol' ActiveX ...
- 443
7
votes
1
answer
3k
views
Can canvas fingerprinting be prevented?
How can canvas fingerprinting be prevented in web browsers? The site Panopticlick said I had a hash of WebGL fingerprint of 5 bits of entropy. I installed CanvasBlocker addon and tested again and it ...
- 10.1k
6
votes
1
answer
2k
views
Youtube.com trying to extract HTML5 canvas data: is Youtube trying to fingerprint users' browser?
While trying to watch a Youtube videos using Tor browser, the Tor browser opens an alert window:
This website (www.youtube.com) attempted to extract HTML5 canvas image data, which may be used to ...
- 633
1
vote
2
answers
1k
views
Is HTML5/JavaScript more secure than Flash/Java, as the browser becomes more like an OS? [closed]
I have been asked to post this here:
I want to focus on the security of the end-user in these two different scenarios:
1) Pre HTML 5 where the applications and so on lived in plug ins outside the ...
46
votes
3
answers
6k
views
For an end-user, is HTML5/JavaScript more secure than Flash?
I’m not talking about server-side security or even necessarily XSS vulnerabilities, as these are attacks on vulnerable services and do not use any pre-existing vulnerabilities on the client side to ...
- 1,027
24
votes
6
answers
7k
views
Alternatives to HTML's deprecated <keygen> for client certs?
The keygen tag is used to make browsers generate private keys and POST the resulting CSR to the server, which can then issue a certificate. It's now been deprecated, for rather stupid reasons but that'...
- 12.8k
12
votes
2
answers
2k
views
Disable HTML5 battery features
HTML5 has a feature set relating to client battery status. It has been described as a privacy hole, as it can be used to track and identify web users. Research suggests the features can be used even ...
- 1,074
38
votes
5
answers
46k
views
Is HTML5 vibrate feature a security vulnerability?
While surfing a news website on my mobile, I receive a virus infection alert warning that triggers my phone to vibrate incessantly. The alert looks like the following:
I didn't expect my phone to ...
- 5,290
8
votes
2
answers
7k
views
Is HTML5 sessionStorage secure for temporarily storing a cryptographic key?
Assume I am building a local web application (e.g. browser extension) in HTML5 to encrypt a database locally. Access to the database is controlled by a password and a cryptographic master key is ...
- 81
2
votes
2
answers
1k
views
Can postMessage be used to forward data to hacker's iframe in CSRF attack?
Consider a user that has an open session to a legitimate site with a password on it. This page has no anti-CSRF token.
A hacker creates a webpage with 2 hidden iframes. One iframe does a GET on the ...
- 121
13
votes
2
answers
10k
views
Preventing CSRF attacks against WebSocket communications
I have read the thread about CSRF attacks in websockets (Do WebSocket-powered web apps (e.g. "comet" apps) have to worry about CSRF?) and also some more material regarding websocket security,...
- 551
1
vote
1
answer
1k
views
Iframe postmessage fraud
I've reviewed some material here and in other sites relating to secure usage of Window.postMessage. There is a bunch of material regarding best practices but one of my questions remained unanswered.
...
- 551
2
votes
0
answers
1k
views
Socket.IO & WebSocket security - query certificate/public key a leak?
Socket.IO and WebSocket do not provide underlying connection information (like the certificate or public key of the SSL/TLS channel), and I'm trying to understand the reasoning.
The context for this ...
user29925
7
votes
1
answer
4k
views
WebRTC P2P SSL - Where are the keys generated?
My understanding is that with the WebRTC peer-to-peer data API, communications between peers are encrypted via a modified form of SSL. Where are the keys for the peer-to-peer SSL connection generated, ...
- 2,272
2
votes
1
answer
223
views
Unusual ownership-ID using localStorage; any possible issues?
I'm working on a small side project in PHP. I may yet include some sort of actual username/password registration down the line, but for now, for ease of attracting attention, my goal is to allow for ...
- 193
16
votes
2
answers
4k
views
Security of running openpgp.js in a browser with the private key in HTML5 localStorage
If I were to write a web application using openpgp.js (http://openpgpjs.org/) for creating PGP encrypted/signed messages and if I stored the user's private key in localStorage, would this be ...
- 163
1
vote
1
answer
157
views
Couldn't websites that want to track our activity just store the data in the DOM?
For example as the value of an attribute of a html tag.
<div cookie='id=1234'></div>
Then if the user deletes the cookies while at least one page of the website is open, a javascript ...
- 141
5
votes
2
answers
2k
views
Is it possible to create a secure chat web application relying on HTML5 web sockets?
Is it possible to create a secure chat web application using just HTML5 and Javascript?
What possible security holes would there be if the server doesn't store the messages, just relay them using ...
- 2,272
21
votes
4
answers
42k
views
Is it safe to store password in HTML5 sessionStorage?
I am trying to improve the user experience on registration by not requiring the user to retype their password if validation on other fields fail. There are a few ways to implement this, example using ...
- 5,290
0
votes
1
answer
274
views
How does DOCTYPE selection affect security of my AJAX app?
I'm considering using modern techniques to protect my Javascript code and am studying how the DOCTYPE element selection may impact that. Specifically, the linked question used IFrames which are not ...
- 50.7k
6
votes
1
answer
18k
views
Websocket implication for firewalls
(I've read several questions here about websocket but apparently there's no websocket tag)
If I understand correctly websockets are using TCP trafic over port 80.
What are the implication, if any, ...
- 587
2
votes
2
answers
2k
views
HTTPOnly Cookies: Security Depends on Client Cooperation?
I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means.
I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
- 463
10
votes
1
answer
3k
views
What are the benefits and drawbacks of the HTML5 Keygen element?
As of January 2013, what are the potential benefits and drawbacks of the HTML5 Keygen element?
- 50.7k
2
votes
2
answers
1k
views
How do I verify, parse and process the results of the HTML5 keygen tag?
I'm investigating the HTML5 attribute Keygen and discovered that it sends this data on a Form POST to the server. Here is an example POST:
...
- 50.7k
22
votes
1
answer
10k
views
How to use postMessage securely
postMessage is a primitive introduced in HTML5 that web pages can use for cross-origin communication.
What do I need to do to use postMessage securely? What are the primary security pitfalls or ...
- 99.5k
3
votes
2
answers
2k
views
HTML Vulnerabilities
My question is three-fold.
Background
I was asked to do some vulnerability scans on a website with some holes (I think). On a particular page, I was able to escape the text field and write on the ...
- 666
6
votes
2
answers
2k
views
HTML 5 Security Code Scanner
Are there code scanners in the market that scan HTML 5 code?
Does anyone have a list of tags of specific CORS configurations that need/can be scanned?
- 1,204