New answers tagged javascript
0
votes
What happens if my anti-CSRF token is compromised by an XSS attack?
An XSS attack, while it is ongoing, strictly dominates CSRF; anything an attacker could do with CSRF, they can do with XSS (and much more besides).
However, there is a question: what happens after the ...
- 46.3k
0
votes
XSS against jQuery PortSwigger challenge
The vulnerable code is this:
<script src="/resources/js/jquery_1-8-2.js"></script>
[...]
<script>
$(window).on('hashchange', function(){
var post = $('section.blog-list h2:...
- 29.5k
0
votes
Is it safe to store the OIDC token in a private field of a javascript object?
Safe enough, sure, lots of sites do this. An attacker who gets XSS on the site might still be able to extract the token, depending on exactly how the function that adds it to API calls is invoked (for ...
- 46.3k
Top 50 recent answers are included