Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [html-5]

HTML5 is a markup language used for structuring and presenting content on the World Wide Web.

1
vote
1answer
130 views

Are the details about the Widevine bug now public?

There was a bug in Widevine last year which enabled downloading Encrypted Media Extension Content. They stated that they would give full details after 90 days. Was this meant for public disclosure or ...
-6
votes
1answer
349 views

Protecting against input type =“password” changes? [closed]

Are there any protections against users using Chrome Developer Tools to right click on a password input field, and then change input type="pass" to "text" to reveal the password? There are probably ...
9
votes
1answer
475 views

Why is a “tainted canvas” a risk?

I understand the concern about a tainted canvas - the idea that the bits of an image from another site can be sent back to a malicious server. But can you explain the details of how exactly this works?...
0
votes
1answer
1k views

Is using enctype=“multipart/form-data” always a bad idea?

If the form doesn't have any file upload, you just use enctype="multipart/form-data" everywhere, is it a bad idea from a security point of view? Here someone says, in 2007 Uusing enctype="...
0
votes
0answers
182 views

Persistent realtime game authentication (JWT, Passport)

Context I am building a MMO game in HTML5 with canvas. I use NodeJS on server & JS from scratch on client. I also use socket.io to manage realtime. The game is persistent & each player keep ...
2
votes
1answer
4k views

How to Pass Authorization Header in HTTP Request when using HTML5 Player (Audio tag) for security

i am using HTML5 audio player as follows : <audio controls> <source src="<url>" type="audio/mp3"> </audio> Now , i want to secure my app , So i want to pass some sessionId ...
5
votes
1answer
795 views

Passing PHP code directly into JavaScript in HTML5

I want to pass a PHP string directly to a JavaScript variable and keep the load on the server to a minimum. I have the following JavaScript in an PHP file for doing this: <!DOCTYPE html> <...
0
votes
2answers
525 views

JWT authentication or cookies?

I am currently creating a login system for my website. To secure the login service, should I use JSON Web Tokens and HTML5 storage, or should I use use the older way of using cookies? Are any of ...
22
votes
5answers
7k views

Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?

An interesting feature of HTML5 is the <input pattern="" /> attribute, which allows the browser to validate the input field's value against a regular expression provided by the developer. ...
-1
votes
1answer
85 views

Vulnerabilities in PHP Form Handling Script [closed]

I'm writing a PHP script that takes input from an HTML5 form, including uploads, and emails them to an administrator using Magento's mail client. I think I've covered the basics pretty well, but I'm ...
1
vote
0answers
454 views

PWA/HTML5 recognized encrypted storage on desktop/mobile browser

Trying to find if there are recognized ways to handle Progressive Web Apps (PWA)/HTML5 type apps on desktop browsers (chrome, firefox) with some form of encrypted local storage that is sufficiently ...
7
votes
1answer
810 views

Why is sub resource integrity (SRI) only limited to certain files?

I'm quite enthusiastic about the Sub resource integrity (SRI) features. But, why is it only limited to JS and CSS files? I tried to pin a LESS (CSS variant) file, of which the integrity tag was ...
5
votes
1answer
153 views

Malware through HTML 5 player

Just curious if it is possible to get malware through a trusted site hosting an HTML 5 player. I would imagine since Chrome is in a sandbox, nothing download to your computer?
6
votes
2answers
914 views

Is it secure to share an access token via HTML5 messaging API between various iframes?

I have a main website that embeds 3 other websites via iframes (legacy systems providing various functionalities with a user interface). Currently the user has to authenticate with each of the system ...
2
votes
1answer
368 views

How to securely access web api from Html5 Website

So the thing is I have created a Asp.Net web api and am using oauth to secure the access. The problem is that the clients want to make a pure html(angular) website from which they will access the api. ...
45
votes
4answers
7k views

How can html5 geolocalisation bypass my vpn?

About two months ago I've decided to use a VPN all the time (it's launched at startup) for various reasons, privacy being the first one. But recently I realized that if you agree to share your ...
3
votes
1answer
1k views

Is there a way to use clear key encryption for protecting media HTML5 media streams?

I am trying to understand EME with Clear Key encryption. I am using MP4Box. From the documentation here, you specify decryption keys in an XML file that is used to encrypt/decrypt your mp4 files. ...
3
votes
1answer
2k views

Browser exploits based purely on HTML + CSS

In 2011, Eli Fox-Epstein demonstrated a Rule 110 machine in HTML + CSS3. This led some to say that the combination of HTML + CSS3 is Turing complete. Regardless of whether HTML + CSS3 is technically ...
4
votes
1answer
172 views

How secure will EME be?

EME is a technology to allow proprietary code to be run in browser to frustrate piracy. What are the security implications of this? Will it have full access to my computer (like the good-ol' ActiveX ...
5
votes
1answer
2k views

Can canvas fingerprinting be prevented?

How can canvas fingerprinting be prevented in web browsers? The site Panopticlick said I had a hash of WebGL fingerprint of 5 bits of entropy. I installed CanvasBlocker addon and tested again and it ...
5
votes
1answer
1k views

Youtube.com trying to extract HTML5 canvas data: is Youtube trying to fingerprint users' browser?

While trying to watch a Youtube videos using Tor browser, the Tor browser opens an alert window: This website (www.youtube.com) attempted to extract HTML5 canvas image data, which may be used to ...
1
vote
2answers
1k views

Is HTML5/JavaScript more secure than Flash/Java, as the browser becomes more like an OS? [closed]

I have been asked to post this here: I want to focus on the security of the end-user in these two different scenarios: 1) Pre HTML 5 where the applications and so on lived in plug ins outside the ...
46
votes
3answers
5k views

For an end-user, is HTML5/JavaScript more secure than Flash?

I’m not talking about server-side security or even necessarily XSS vulnerabilities, as these are attacks on vulnerable services and do not use any pre-existing vulnerabilities on the client side to ...
20
votes
4answers
3k views

Alternatives to HTML's deprecated <keygen> for client certs?

The keygen tag is used to make browsers generate private keys and POST the resulting CSR to the server, which can then issue a certificate. It's now been deprecated, for rather stupid reasons but that'...
12
votes
2answers
1k views

Disable HTML5 battery features

HTML5 has a feature set relating to client battery status. It has been described as a privacy hole, as it can be used to track and identify web users. Research suggests the features can be used even ...
38
votes
5answers
45k views

Is HTML5 vibrate feature a security vulnerability?

While surfing a news website on my mobile, I receive a virus infection alert warning that triggers my phone to vibrate incessantly. The alert looks like the following: I didn't expect my phone to ...
7
votes
2answers
4k views

Is HTML5 sessionStorage secure for temporarily storing a cryptographic key?

Assume I am building a local web application (e.g. browser extension) in HTML5 to encrypt a database locally. Access to the database is controlled by a password and a cryptographic master key is ...
2
votes
2answers
622 views

Can postMessage be used to forward data to hacker's iframe in CSRF attack?

Consider a user that has an open session to a legitimate site with a password on it. This page has no anti-CSRF token. A hacker creates a webpage with 2 hidden iframes. One iframe does a GET on the ...
7
votes
2answers
3k views

Preventing CSRF attacks against WebSocket communications

I have read the thread about CSRF attacks in websockets (Do WebSocket-powered web apps (e.g. "comet" apps) have to worry about CSRF?) and also some more material regarding websocket security,...
1
vote
1answer
651 views

Iframe postmessage fraud

I've reviewed some material here and in other sites relating to secure usage of Window.postMessage. There is a bunch of material regarding best practices but one of my questions remained unanswered. ...
1
vote
0answers
1k views

Socket.IO & WebSocket security - query certificate/public key a leak?

Socket.IO and WebSocket do not provide underlying connection information (like the certificate or public key of the SSL/TLS channel), and I'm trying to understand the reasoning. The context for this ...
7
votes
1answer
2k views

WebRTC P2P SSL - Where are the keys generated?

My understanding is that with the WebRTC peer-to-peer data API, communications between peers are encrypted via a modified form of SSL. Where are the keys for the peer-to-peer SSL connection generated, ...
2
votes
1answer
150 views

Unusual ownership-ID using localStorage; any possible issues?

I'm working on a small side project in PHP. I may yet include some sort of actual username/password registration down the line, but for now, for ease of attracting attention, my goal is to allow for ...
16
votes
2answers
4k views

Security of running openpgp.js in a browser with the private key in HTML5 localStorage

If I were to write a web application using openpgp.js (http://openpgpjs.org/) for creating PGP encrypted/signed messages and if I stored the user's private key in localStorage, would this be ...
1
vote
1answer
83 views

Couldn't websites that want to track our activity just store the data in the DOM?

For example as the value of an attribute of a html tag. <div cookie='id=1234'></div> Then if the user deletes the cookies while at least one page of the website is open, a javascript ...
5
votes
2answers
2k views

Is it possible to create a secure chat web application relying on HTML5 web sockets?

Is it possible to create a secure chat web application using just HTML5 and Javascript? What possible security holes would there be if the server doesn't store the messages, just relay them using ...
11
votes
4answers
22k views

Is it safe to store password in HTML5 sessionStorage?

I am trying to improve the user experience on registration by not requiring the user to retype their password if validation on other fields fail. There are a few ways to implement this, example using ...
0
votes
1answer
228 views

How does DOCTYPE selection affect security of my AJAX app?

I'm considering using modern techniques to protect my Javascript code and am studying how the DOCTYPE element selection may impact that. Specifically, the linked question used IFrames which are not ...
5
votes
1answer
14k views

Websocket implication for firewalls

(I've read several questions here about websocket but apparently there's no websocket tag) If I understand correctly websockets are using TCP trafic over port 80. What are the implication, if any, ...
2
votes
2answers
1k views

HTTPOnly Cookies: Security Depends on Client Cooperation?

I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means. I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
9
votes
1answer
3k views

What are the benefits and drawbacks of the HTML5 Keygen element?

As of January 2013, what are the potential benefits and drawbacks of the HTML5 Keygen element?
2
votes
2answers
964 views

How do I verify, parse and process the results of the HTML5 keygen tag?

I'm investigating the HTML5 attribute Keygen and discovered that it sends this data on a Form POST to the server. Here is an example POST: ...
19
votes
1answer
6k views

How to use postMessage securely

postMessage is a primitive introduced in HTML5 that web pages can use for cross-origin communication. What do I need to do to use postMessage securely? What are the primary security pitfalls or ...
3
votes
2answers
1k views

HTML Vulnerabilities

My question is three-fold. Background I was asked to do some vulnerability scans on a website with some holes (I think). On a particular page, I was able to escape the text field and write on the ...
6
votes
2answers
2k views

HTML 5 Security Code Scanner

Are there code scanners in the market that scan HTML 5 code? Does anyone have a list of tags of specific CORS configurations that need/can be scanned?
7
votes
3answers
2k views

How secure are self decrypting HTML files for data storage?

I recently came across a JavaScript self decrypting archive. Is it secure enough to be used as a portable password storage tool? The author has even challenged it to be cracked.
9
votes
3answers
2k views

Are there any established secure coding guidelines available for mobile devices?

I am looking for secure coding guidelines especially for mobile devices (Android and iOS). The languages I am interested in are Objective-C, JAVA and HTML5. Would it be a good approach to use a "...
10
votes
3answers
2k views

localStorage for apps over https. What expectations are there?

I run an online gradebook. To keep student data private, I transfer all data over https. Now, I'd like to use localStorage to avoid redundant calculations and server requests. However, according to ...
30
votes
3answers
13k views

What useful things can I do with the html5 “keygen” element?

There's a new* keygen element in the html5 spec. It's supported in major browsers excepting Internet Explorer and Safari. Here's what it looks like: <form action="processkey.cgi" method="post" ...
13
votes
3answers
1k views

Elaborate websockets security

I'm interested in learning more about web sockets security. Read that web sockets were originally in Firefox, removed for security reasons and now added back in with the problem resolved: http://news....