The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Hot answers tagged

3

Your question links to a blog post by Paul Irish, which mentions that this is now considered an anti-pattern. (Since 2017) Why was // used at all? The reasoning was that you could write //mysite.com/some/resource and it would resolve to either http://mysite.com/some/resource or https://mysite.com/some/resource, depending on whether or not the site was ...


3

If attacker replaces original CSS file with a malicious CSS file and if the web-server sends this malicious CSS file to the client, can the attacker execute some code in the client? Executing client-side code via CSS does not work in modern browsers. I highly recommend taking a look at "Scriptless Attacks – Stealing the Pie Without Touching the Sill", "CSS:...


2

Stealing information is not easily possible and not what Clickjacking is really about. Clickjacking is functionally similar to CSRF, in that you can perform actions on the site across origins, but you cannot retrieve information. With Clickjacking, you can perform any click actions, and potentially also enter text by dragging it into the iframe (depending ...


2

This approach does not seem ideal since it is common to find bypasses when it comes to blacklists. There are some great resources out there such as "Scriptless Attacks – Stealing the Pie Without Touching the Sill" and LiveOverflow's recent video "The Curse of Cross-Origin Stylesheets" if you are interested in learning more on scriptless attacks that rely ...


1

This answer might be considered as a partial answer since it's not intended to be exhaustive. With CSS only, a 3rd party can indeed (to a certain point) fingerprint a user's browser by: CSS querying by detecting some browser's unique properties (using prefixes. For example, Chrome & Safati present CSS properties prefixed with -webkit-) Retrieving ...


1

It's a bit unusual to publish a CSS file which the minify process failed on, and may be indicative of other issues (e.g. insufficient monitoring of the deployment process), but CSS files are used by end user browsers, so the content shouldn't be sensitive. At most, it might include styles which are applied to pages or controls which the current user doesn't ...


1

My website is simple (a blog) HTML and CSS and I store nor ask for any data from the visitors. Are you sure your site is only HTML+CSS? Your site wouldn't happen to be using some free hosting service that collects and sells user data, would it? The fact that they're adding URL parameters that have nothing to do with your pages (the /?i=1), and that you get ...


Only top voted, non community-wiki answers of a minimum length are eligible