0
votes
1answer
63 views

Access-Control-Allow-Origin possible threats on static JS file

As I am working on a research, I need allow users to read my JavaScript file using Ajax. However, I want to make sure about consequences of adding Access-Control-Allow-Origin header for just this ...
2
votes
4answers
233 views

Why aren't we all compromised on the internet?

Well, I've been thinking about this for a while now. Within the last decade, we've used various ways to make our websites look dynamic and live. For example, in JavaScript, it's quite easy to send ...
2
votes
1answer
498 views

Cross site Scripting in HTTP Method?

Lately, I've noticed that many web server configurations reflect the method of an HTTP request sent with a non implemented method in the body of the server's response. For example, A request sent ...
-1
votes
2answers
116 views

Protecting sensitive content in JS source code and Ajax cals [closed]

I've been trying to see how to properly protect important content that's passed in ajax calls with java script. Considering JavaScript can be viewed at any point, it is inevitable that some of your ...
2
votes
2answers
1k views

How to stop other website to send cross domain ajax requests?

From 2 different applications, I was able to send cross-orgin requests. Though the browser return an error of Cross-Origin, but my server is still receiving and executing the request. For example, ...
1
vote
2answers
199 views

Can older or custom web browsers override the same origin policy?

I totally understand the basis of origin policy and the reasoning why all modern browsers have put this policy into place. My question I guess is, do older browsers support this, and if they don't, ...
1
vote
1answer
1k views

Certificate authentication with jQuery's ajax() function

I need to sync with my server with the client certificate abc.pfx which is generated by the server using Ajax. How do I send my certificate with Ajax object. Can I do this certificate authentication ...
-2
votes
1answer
235 views

When logging into a web page what exactly happens when a user types the wrong password?

I have two related questions as to what happens when a user tries to log in to a website If the entered password is wrong what should happen? I have two ideas: Redirect to a page saying "wrong ...
1
vote
2answers
648 views

HTTP Response Splitting

Is this apart of a HTTP Response Splitting attack ? Here below is some code that gets put into a web browser after clearing the url while on the website javascript: var xhr = new XMLHttpRequest(); ...
0
votes
3answers
3k views

Set Cookie in XHR response : How different browsers handle this?

If I send a XHR request to example.com and response has Set-Cookie: dummyCookie=dummy in response. How different browsers handle this? Does any version of any browser set the cookie for ...
2
votes
4answers
1k views

Without using SSL, what's the most secure way to make an AJAX request to a PHP page?

It was suggested over at stackoverflow that I try my question here. This is it verbatim: So, it's impossible to do AJAX requests securely without using SSL. I get it. You can either view-source the ...
5
votes
1answer
3k views

Is this jQuery ajax call vulnerable to XSS?

If somebody can edit $("#field").val(), can they change the url property here to point to another location? $.ajax({ url: "http://mywebsite/script?param=" + $("#field").val(), dataType: "jsonp", ...
6
votes
3answers
7k views

Secure jquery ajax calls from a non secure page

I could not find a clear answer, but if I have the following situation: I browse to a page let's say http://www.example.com/index.html Now I use a form on this page to do a postback with jquery's ...
6
votes
1answer
609 views

Access to other local files from a local HTML file

I tried this question on programmers site with no luck Do you see any reason to block a local html file from accessing another local files located in the same folder? I mean, if a user downloaded an ...