Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

Filter by
Sorted by
Tagged with
0
votes
1answer
134 views

Why does Chrome display "Managed by Organisation"? [closed]

My wife inadvertently clicked on a flash player update and suddenly my chrome browser displays that it is being managed by an Organisation. I tried deleting chrome and reinstalling it but nothing ...
1
vote
0answers
164 views

Why are DNS prefetch requests sent in clear text with DNS over HTTPS enabled?

I am trying to understand how DNS-over-HTTPS (DoH) works in both Chrome and Firefox browsers. To do so, I have enabled DoH on each browser and set the DNS provider to Cloudflare DNS servers (1.1.1.1 ...
0
votes
0answers
190 views

Clear Browser Cache of Certificates Used for Authentication

We are using cert based authentication where the client sends a cert to the server, which is validated for authentication for a web application. This all works well. The problem happens when the user ...
-1
votes
1answer
131 views

LinkedIn connection marked unsafe

From time to time my LinkedIn connection gets marked as unsafe: no green lock next to the URL. First, I believed this was a browser issue, but after I switched to another browser, the warning did not ...
0
votes
1answer
74 views

Is it possible for a website to get information about you through its upload feature?

Reddit has a new image upload feature that takes a very long time to work after you click submit-- as long as 30 seconds. It isn't caused by the upload itself; that happens very quickly. I don't know ...
2
votes
1answer
105 views

Is possible to implement a Web Cryptography API custom provider?

I'm reading some basic info about Web Cryptography API and I'm wondering if is possible to implement some crypto provider (C/C++ library or something) with some extra algorithms or is mandatory to use ...
1
vote
1answer
172 views

Which approach is technically more effective to hinder user tracking - fingerprint generalization or randomization?

Tor's approach to countering fingerprinting is to make as many users "appear the same" as possible. Let us call this "generalization". While Brave tries to randomize all fingerprints of each and every ...
0
votes
0answers
98 views

Restricting website usage for Google Maps API doesn't prevent it from being used in the browser?

Say I've restricted my Google Maps API key to the website example.com/*. This would mean that no other website domains could use my API key to make requests to maps.googleapis.com. However, using the ...
0
votes
1answer
89 views

Credential theft by browser conferencing software?

While using the webex conference software, I noticed that simply pressing a "share content" button allows me to share my full screen. There was no security confirmation from my webbrowser (chrome): I ...
1
vote
1answer
167 views

Why did browser authors not make 127.0.0.1/localhost-hosted webpages skip the referrer?

For a long time, I was so convinced that 127.0.0.1/localhost-hosted webpages, that is, with URLs such as: http://127.0.0.1/MySecretControlPanel/sensitive.php?stuff=goes&here=dude ... did not ...
0
votes
0answers
75 views

Domain Joined computer doesn't browser properly with any website with Let's Encrypt CA cert

Navigating to any website with Let's Encrypt CA cert and even after enabling the HTTPS Everywhere addon, I'm getting "Your connection is not private". Getting this error from all the browser except ...
10
votes
3answers
459 views

Risks of Long-life Session

Most "big" websites seem to have enormous sessions. From looking through the cookies, Stack Exchange seems to have a one-week rolling session, GitHub has 45 days, and Gmail seems to have a never-...
1
vote
3answers
205 views

I entered my password manager password in the browser URL field [duplicate]

I saw various questions on a similar note but not quite the same as my situation: I entered my password manager's password into the browser URL bar and hit enter. Has this breached the confidentiality ...
0
votes
1answer
567 views

Playing a shared video file or viewing a pdf file in "incognito/private mode"

I know how incognito/private tab works. But I'm not sure private mode works as expected in this situation: If someone uses Chrome "incognito/private mode" on Android device and plays a video file or ...
1
vote
1answer
73 views

Do browsers still send cookies if I choose to visit an unsafe site warned by browsers?

For example, assume I get a NET::ERR_CERT_AUTHORITY_INVALID warning in Chrome, when visiting a website. If I still choose to visit that site, do cookies still get sent as usual (when the site is safe, ...
1
vote
5answers
567 views

Username in browser history (url) - is this a security problem?

We have a client complaining that there is PII in the browser history (as in the persistent history you get to through your browser's menu - Ctrl + H in Chrome). For example, the URL for editing a ...
2
votes
1answer
1k views

Encryption and decryption in the browser on the client's side – is it safe?

There is a possibility to download the file with one’s PII from the dedicated web server. The file might be decrypted by filling the two factors. These two factors are delivered via email and SMS. The ...
0
votes
1answer
101 views

How do I restrict network access to websites using a monitoring system?

I am making a Java Project a LAB MONITORING SYSTEM for my University practical exams. Where a teacher or admin can monitor some selected computers and can give permissions to what the user at that ...
2
votes
1answer
585 views

URL Contains Sensitive Data - Alternative Besides Switching To Post?

One of my company's clients recently produced an application security assessment report, noting a list of violations based on OWASP's top 10 list of web application security risks. One of the ...
2
votes
1answer
106 views

What measures can be taken to make a site safe again after a hostile service worker is installed in users' browsers?

So my understanding of Service Workers is that once installed they grant you full control over requests to a domain. If an attacker managed to include their service worker in your site, then for ...
0
votes
1answer
845 views

How to bypass origin based csrf protection?

I'm trying to do some csrf attack test on a site. I found that the site protect itself from csrf by checking the http Origin header. But I guess maybe under some conditions I can bypass the ...
1
vote
1answer
368 views

How to store private keys in browsers after Apple's decision to wipe script-writeable storage?

We have a web application that puts a private key in LocalStorage, which enables users to sign off certain messages. It's been working fine until today we saw this announcement from Apple. The TLDR; ...
0
votes
2answers
201 views

Saving authorization token in browser [duplicate]

I have a REST API which returns an auth token when the user is logged in successfully. This token needs to be sent in different routes for authorisation. This is working fine is my android app. But I ...
0
votes
1answer
8k views

Can my employer see my browsing history with work account on my personal device

I was using Edge on my personal device at home browsing stuff and realised I was logged in on Bing.com with my Microsoft work account. I cleared my browser's browsing history and also Bing's browsing ...
4
votes
1answer
1k views

Is there any way to access the contents of a cross domain iframe

I found that a subdomain of a site leaks all cookies of the site due to improper error handling. Now, I found that this site does not have X-Frame Options Header in it. So, I put this subdomain in the ...
0
votes
1answer
150 views

Flash Vulnerabilities

What type of risks do I expose myself to by enabling flash in the browser? Web developers or online game developers who can use those vulnerabilities to crash my computer or exploit it by downloading ...
1
vote
1answer
177 views

How can i cause a redirect in browser?

I'm able to edit a parameter which is then reflected inside a link. I'd like to know how and if it's possible to cause a redirect. In shorts when i edit the parameter example like this example=/test....
0
votes
0answers
83 views

Are browsers vulnerable to Authorization Code Interception Attacks?

RFC7636 states "The operating systems must allow a custom URI scheme to be registered by multiple applications." Are web apps vulnerable to this attack? Could a web app link open a malicious ...
0
votes
1answer
241 views

How do browsers detect authentication type?

To elaborate, HTTP basic auth is pretty straightforward - we can skip that. Auth with client certs is cumbersome and unpopular - skip that too. What I am really interested in is: With form-based auth,...
-2
votes
2answers
167 views

How will disabling location share from browser prevent website from obtaining my IP and locating me?

I am a bit confused of how does the "sharing your location" feature works in browsers. Assume I am using Chrome, I have the following questions: When a website prompt the pop-up request "this website ...
0
votes
1answer
441 views

How does a web client check the signing authority of a server certificate? [duplicate]

In HTTP The Definitive Guide When you establish a secure web transaction through HTTPS, modern browsers automatically fetch the digital certificate for the server being connected to. If the ...
0
votes
1answer
170 views

Youtube/Firefox access to my history

I recently noticed something weird. From time to time I watch on YouTube (Firefox) something political. In my case 'lastweektonight'(left) and 'StevenCrowder'(right), (because it is fun to see, where ...
0
votes
2answers
308 views

index.html integrity

Is it possible to make browsers verify that index.html matches some checksum? Context: With subresource integrity, you can specify SHA hashes for URLs, so that you know that you are getting the ...
2
votes
1answer
159 views

Is this sufficient to verify a website's domain?

I'm building a browser extension that will run some javascript, which contains some sensitive information (essentially injecting authentication info). Therefore I want to make sure it only executes it ...
2
votes
2answers
324 views

using NoScript - what approach to use with randomnly named CDN scripts?

I ran across this on namecheap.com. This question isn't about namecheap.com itself, which I have no problem trusting. Rather, what approach do you recommend in dealing with CDN scripts that have ...
0
votes
2answers
203 views

Why not sandbox websites instead of using Same-Origin-Policy?

Why do Browsers implement a Same-Origin-Policy (SOP) to prevent open websites in the browser from executing scripts that may access / modify data of other open websites in the used browser? Another ...
1
vote
0answers
90 views

SSO and browser vs. server

We've got implementations in a browser-based system right now that does both SAML and OpenID-connect login support, but does them differently and was looking for advice on the risks. Our SAML ...
0
votes
1answer
142 views

What attacks can be done from a "sketchy" internet site

I've heard that tabs in modern web browsers are fairly well sandboxed, so what kind of attacks could a malicious site do to your computer and/or web browser assuming you don't do anything obviously ...
2
votes
1answer
1k views

Can WebAssembly execution be disabled in browsers?

I've recently found out about this new technology, which recently became a World Wide Web Consortium recommendation and also that now almost all main browsers support it and it is enabled by default, ...
3
votes
2answers
1k views

"Tor Profile" folder in Brave Browser cache

I am using Brave Browser Version 1.0.0 Chromium: 78.0.3904.97 (Official Build) (64-bit) on Ubuntu 18.04. The browser has an option, open new private window with Tor . When looking into cache files ...
-2
votes
1answer
99 views

What part of this request can be logged? [closed]

While testing a website i noticed a weird behaviour. When resetting the password a POST request with empty body is generated. The request is the following: POST /reset/token/[token]/passwhord-hash ...
2
votes
1answer
666 views

Is there any drawbacks of "accepting all cookies" while in incognito mode?

Since the GDPR landed, many websites have to inform you about their cookie usage and give you an option to enable/disable them for provider and for reason of storage. Say that I find a link I want to ...
2
votes
1answer
88 views

Code Change That Resulted in Database Fields and Values Exposed

At my company, we have a new development team that has been completely rewriting all of the code for different parts of the system. I've noticed that with one of the recent changes, you can now see ...
3
votes
1answer
175 views

A workaround for external website's HTTP registration page

There is a website which I want to register for but it is a internship/job-seeking website and thus on registration some VERY sensitive data is required. When registering Firefox alerted me that the ...
0
votes
1answer
173 views

Is there a vulnerability other than XSS which can result in client side script execution?

If the intention of attacker is to execute an arbitrary client side script in the context of a web application, is XSS the only possible attack other than compromising the server with an RCE or a sub-...
40
votes
1answer
6k views

Can a browser extension (Chrome, Firefox, etc.) read the web console log?

I realized that my bank handles sensitive information in the web console log, so my concern is if any browser extension could read the log?
17
votes
3answers
4k views

What use would a privacy browser, such as Firefox Focus for iPhone, have for an internal web server?

The Mozilla Foundation has a "privacy browser" called Firefox Focus that is available for example iPhone (here). This browser has an always-on ad blocking function. I was checking the third-party ...
0
votes
2answers
822 views

Why does Firefox (version 71.0 (64-bit)) indicate “weak encryption” but Google Chrome (Version 79.0.3945.88) does not?

I read that Mozilla uses its own trust certificate store but does "weak encryption" have anything to do with whether the browser trusts the certificate? Has it got anything to do with the signature ...
0
votes
1answer
141 views

Why is JavaScript executed manually from the browser console not allowed to access everything?

Why is JavaScripts executed manually from the browser console not allowed to access "everything"? Especially the "visited" status (see this question) of links? What kind of security threat would that ...
42
votes
7answers
6k views

Will the same JavaScript fetched by HTTP and HTTPS be cached separately by the browser?

Say that a web server supports both HTTP and HTTPS. If a browser fetches the same JavaScript with a HTTP GET and a HTTPS GET, and the JavaScript is cache-able, will the browser cache two copies of the ...

1 2 3
4
5
32