The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

2
votes
2answers
323 views

Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?

I came across a project called jCryption 3.0, which encrypts data between the client and server, without using SSL. If a website's JavaScript had used jCryption 3.0 to encrypt login form fields before ...
1
vote
2answers
145 views

Attack using weird characters followed by some javascript in a URL?

I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this: /js/bundles/,!0):this.element.propAttr( ...
0
votes
2answers
26 views

Preventing SSL strip attack

Is it possible to detect a ssl strip attack by checking whether the page deliverd is https or http using javascript?I am assuming that the response page is https page instead of http?
3
votes
1answer
59 views

Limiting latter dom-based XSS when setting document.title

Given some JavaScript which modifies the page's title by taking in variable data document.title = someVariable I am looking to address dom based XSS while keeping the title fairly readable. ...
3
votes
1answer
940 views

How to secure my REST implementation for an ember.js app

I've been searching and searching for what seems days and have not come up with any definitive answer on a solution to my problem. To explain without going into terrible detail I am building a store, ...
2
votes
1answer
78 views

Securely identify clients by web app

I have a web service S that provides certain services. There are two web apps, A1 and A2, both on different servers within the same VPN, which I trust and want to grant access to my web service. ...
1
vote
1answer
22 views

What are the best practices for (token based) security in a webapp?

I am designing a web application using Spring MVC with REST controllers and Angular JS pages which communicate with these REST controllers. I've implemented a token based security/ authorization ...
1
vote
1answer
31 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = ...
2
votes
0answers
73 views

How does JavaScript Injection work?

I was watching a DefCon talk and the speaker was saying he was able to infect JavaScript cache files, once the user visited his website/server. From there he was able to load scripts from other sites ...
2
votes
0answers
63 views

Can source javascript files be infected from a developer's machine?

First a little bit of background, About two weeks back one of the developers in my team said they were seeing advertisement popups and links appearing all over the web app we were developing, when ...
2
votes
0answers
50 views

Securing a JavaScript app with RESTful backend

I went through the question Securing a JavaScript Single Page App with RESTful backend that has discussions / options around securing a Javascript client side app that invokes RESTful APIs. However, ...
1
vote
0answers
49 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. ...
1
vote
0answers
125 views

XSS Vectors for new Image()

What are possible XSS vectors to this JavaScript code new Image().src = encodeURI('[user url here]'); Let's assume two cases: [user url here] is some string provided by user (with no validation) ...
1
vote
0answers
107 views

Hacking attempts:in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an "in.js" file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
0
votes
0answers
40 views

Problem in 'underscore.js' “new Function()” when CSP header is set.

In underscore.js, template rendering causes violation of the 'unsafe-eval' property, with CSP error at following line: "render = new Function(settings.variable || 'obj', '_', source);" The solution ...
0
votes
0answers
29 views

Securing REST API with HMAC and SPA

I'm developing a JS based SPA and the backend is a rest api which uses HMAC. The site/app doesn't have the concept of registered users but it has the concept of session. How do i make sure that the ...
0
votes
0answers
133 views

Best practices to invalidate JWT while changing passwords and logout in node.js?

I would like to know the best practices to invalidate JWT without hitting db while changing password/logout. I have the idea below to handle above 2 cases by hitting the user database. 1.Incase of ...
0
votes
0answers
74 views

Securing my API: concept of access tokens

First of all I want to excuse for the bad spelling and grammar. English is not my mother tongue. I have built a JSON communication between a front-end (website) and my Node.js web server. I want to ...