39 votes

How does CSRF correlate with Same Origin Policy

Let us start by defining the term "origin". The origin of a page is decided by three unique factors: hostname, protocol and port number. For example, http://test.com and https://test.com have ...
Shurmajee's user avatar
  • 7,457
11 votes

Can a website make an HTTP request to "localhost"? How does it get around the cross-domain policy?

Im surprised nobody has pointed out that the accepted answer (by meltdownmonk) is wrong. "It will not break cross domain policy, because the request will not cross domains. It will stay local. ...
maxeh's user avatar
  • 376
11 votes

How does CSRF correlate with Same Origin Policy

Same Origin Policy (SOP) preserves the data of other domains... There are two parts to the SOP: It prevents scripts on origin A from reading data from origin B. It prevents sites on origin A from ...
Anders's user avatar
  • 65.6k
8 votes
Accepted

Secure ajax login form

TL;DR: Just use HTTPS and send the credentials, unhashed, in a POST request. It's much safer, simpler, and takes care of passive monitoring, MITM, and replay attacks all at the same time. Are there ...
CBHacking's user avatar
  • 48.4k
7 votes
Accepted

Is HTTP POST any more secure than HTTP GET for AJAX?

You should use POST for any state-changing action. If you save the content of the form, or use the form to send an e-mail, you should use a POST. There are several reasons why this is more secure: ...
Sjoerd's user avatar
  • 30.6k
7 votes
Accepted

Is an AJAX call less secure than the normal POST method?

They are both equally secure. There are mistakes you could make in any version, but none is inherently better than the other. What is relevant for the security of your login is the server side. You ...
Anders's user avatar
  • 65.6k
6 votes
Accepted

Does appending data from a form to a URL with encodeURIComponent safely sanitize user input?

Yes, encodeURIComponent() is the correct way to safely fill a query parameter with untrusted data. E.g., to set a parameter q to a user-supplied userString, this is fine and safe: `https://www.example....
Arminius's user avatar
  • 44.8k
5 votes

How does CSRF correlate with Same Origin Policy

A site A can cause a request to the different site B in various ways, for example with including an image from site B inside the HTML from site A (i.e. <img src=http://B/...>) or do similar things ...
Steffen Ullrich's user avatar
5 votes
Accepted

Reflected XSS via JSON executed with Burp, but how to do it in realistic conditions?

The proposed reflective XSS vulnerability is completely and totally unexploitable by modern browsers due to the following content-type: Content-Type: application/json;charset=UTF-8 The content-type ...
rook's user avatar
  • 47.2k
5 votes

document.cookie and its scope

If the domains were the same, so the cookies were set on http://example.com/home/, and didn't have HTTP Only set, but there was an XSS vulnerability in http://example.com/vulnerable/, then the cookies ...
JackW's user avatar
  • 713
5 votes
Accepted

Bypass CAPTCHA form made with 100% JavaScript?

If it is a secure CAPTCHA, the AJAX message will send the user's input to a server. The server will validate the input and return a token. The token will then be inserted into the form by the ...
Neil Smithline's user avatar
5 votes
Accepted

How do I prevent XSS in direct access to AJAX/JSON APIs?

Setting content-type to plaintext or JSON and not HTML? If the API returns JSON, then you should the content type to application/json. Apart from just being correct, this will also stop any XSS ...
Anders's user avatar
  • 65.6k
5 votes
Accepted

Is xhr.withCredentials making POST endpoints vulnerable to CSRF?

You don't need an AJAX request, the standard approach to exploit this issue would be: <form id="myform" method="post" action="http://mysite.vulnerablesite.com/mysite/deleteUser" > <input ...
tim's user avatar
  • 29.6k
4 votes
Accepted

Is same origin policy for web only useful because of cookies?

No, the Same Origin Policy also protects against: Cross domain manipulation in the DOM (e.g. a page manipulating another page from another origin loaded in an IFrame). The response from AJAX requests ...
SilverlightFox's user avatar
4 votes

How can I prevent reflected XSS in my JSON web services?

The following points should be kept in mind The potential XSS vulnerability can be avoided by using the correct Content-Type. All JSON responses should use the application/json type. The nosniff ...
Mohammed Farhan's user avatar
4 votes
Accepted

document.cookie and its scope

So in this case when the attacker's script says document.cookie now, will the attacker be able to read the session cookie of the victim? No, the AJAX request can be sent and read due to the XSS ...
SilverlightFox's user avatar
4 votes

Is CSRF protection useless with AJAX?

Yes, you very probably need to run some check to ensure the authenticity of the request. Basically, what is it possible from a third party website ? Send cross site request from html form with ...
Xavier59's user avatar
  • 2,924
4 votes
Accepted

Using browser XMLHttpRequest to initiate credit card transaction with processor?

This is potentially a reasonable approach, but it comes with some conditions that may not make it palatable for you to use. Before I begin I think it's worth me mentioning that I worked for a PCI ASV/...
Polynomial's user avatar
  • 135k
3 votes
Accepted

No Preflight Request is made during XHR cross-origin request

A preflight request to check for CORS headers is only done if the request done with XHR could not be achieved without XHR. In your case you are just doing a simple GET request with no special headers ...
Steffen Ullrich's user avatar
3 votes
Accepted

How to GET security answer values via AJAX for user edit

Is the best choice to use some fake text to show in the box and then check that fake text on save? Yes, this sounds like the way to go. This option doesn't show the true number of characters for ...
SilverlightFox's user avatar
3 votes
Accepted

Using browser AJAX to initiate credit card transaction with processor?

Never trust the client browser. There are four main attack vectors I can see based on this model. 1) Leaked credentials First, as @JuliePelletier commented, in order for this to work, all the ...
Bobson's user avatar
  • 1,465
3 votes

Is same origin policy for web only useful because of cookies?

To add to SilverlightFox' excellent answer: Even if browsers did not send HTTP Auth headers and cookies with cross-domain requests (which is not practical because too many pages rely on this), cross-...
sleske's user avatar
  • 1,634
3 votes

What purpose does Access-Control-Allow-Origin have?

CORS policy limits what code loaded from site A and executed on your browser can do with site B, i.e. limits what cross-origin requests can do. It is not to restrict what can be done with site B in ...
Steffen Ullrich's user avatar
3 votes
Accepted

What purpose does Access-Control-Allow-Origin have?

It's name says "allow" from which I understand that if I make a request from an "Origin" that is not allowed the request should fail. That is right (depending on the request). But disallowing a ...
tim's user avatar
  • 29.6k
3 votes

How can I prevent requests from the browser console while still using ajax?

You can't. Any legitimately authenticated user can absolutely manipulate any http request made to your API. Using a proxy such as Fiddler or Burp or just the browser console they can adjust headers, ...
ste-fu's user avatar
  • 1,092
3 votes
Accepted

Protecting from console attacks

No, you can not tell if a request came from the console, because when you have a client-server application, client and server are black boxes to each other. A request could come from the javascript ...
Philipp's user avatar
  • 49.4k
3 votes

Is an AJAX call less secure than the normal POST method?

Like Anders said, it doesn't really matter - Be it AJAX or non-AJAX. The main security principles rely on how you secure the codes. OWASP Testing Guide is a good start for you to take a look. ...
yehg.net's user avatar
3 votes
Accepted

Why do so many websites use third-party sites for hosting JavaScripts?

Cost Everything you load from someone else is one less thing you need to host yourself. The literal cost (and risk of downtime) of hosting may be small, if you're already hosting your own HTML etc, ...
ShapeOfMatter's user avatar
3 votes

Can somebody explain why the IP address 192.168.1.1 is apparently "special" and not following the CORS rules?

They're not being treated differently. As explained in the answers to the original question, if a malicious site had a script that requested //127.0.0.1/private.txt, they would not be able to read ...
Ghedipunk's user avatar
  • 6,050

Only top scored, non community-wiki answers of a minimum length are eligible