Hot answers tagged

159 votes
Accepted

Important data can be modified from the developer console. What should I do?

Most of the details in your question are irrelevant. That the ID is stored in a HTML id attribute, the developer tools, that you are using jQuery... None of that really matters. The only thing that ...
Anders's user avatar
  • 65.6k
67 votes
Accepted

Why would I ever use AES-256-CBC if AES-256-GCM is more secure?

CBC and GCM are quite different. Both are secure when used correctly, but CBC isn't as parallelizable and lacks built-in authentication. Due to this, CBC is only really practical for encrypting local ...
Therac's user avatar
  • 2,650
35 votes

What is the difference between JWT and encrypting some json manually with AES?

JSON Web Tokens (= JWTs) are based on the RFC 7519 and all differences will be extensively described there. If you take a look at this, you will see, that they are much more than what you seem to have ...
Tom K.'s user avatar
  • 7,975
30 votes

Why would I ever use AES-256-CBC if AES-256-GCM is more secure?

Big nitpick: GCM = CBC + Authentication. Nope, GCM = CTR + Authentication. But in general you are right; CBC is an older mode that was invented back in the dark ages cryptographically speaking (...
Luis Casillas's user avatar
19 votes
Accepted

How does including a magic prefix to a JSON response work to prevent XSSI attacks?

XSSI works by trying to evaluate a JSON response as Javascript and the sequence )]}' prevents this by reliably producing a syntax error. There have been different proposed countermeasures against ...
Arminius's user avatar
  • 44.7k
18 votes
Accepted

Is a backend API server vulnerable to CSRF?

Our application is a pure backend server. Serving JSON APIs to the users. Users will be calling these APIs from their backend in 99.99% of the cases. ... It does not matter what the API is serving or ...
Steffen Ullrich's user avatar
14 votes

Why would I ever use AES-256-CBC if AES-256-GCM is more secure?

CBC is older, which means more compatibility and just overall historical reasons. There are performance advantages, if you don't need GCM for authenticity. You often may want your own system for ...
Peter Harmann's user avatar
13 votes

What is the difference between JWT and encrypting some json manually with AES?

From my other sec.SE answer: JWT are self sufficient tokens which are used to share authentication information between different systems. They solve the problem of relying on third parties for ...
Shurmajee's user avatar
  • 7,447
12 votes
Accepted

CSRF with JSON POST when Content-Type must be application/json

Is this application vulnerable to CSRF attack? Yes, it's vulnerable. The prerequisite, however, here is Flash. With the help of Flash, it's possible to forge a Content-type header with any arbitrary ...
1lastBr3ath's user avatar
12 votes
Accepted

JSON API response flagged as XSS by vulnerability scanner. Is this a false positive?

This isn't vulnerable to XSS since the Content-Type is set to application/json and thus no Javascript will be executed by all major modern browsers. If you do some fancy Javascript stuff with the JSON ...
layton's user avatar
  • 136
11 votes
Accepted

XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?

This is often brought up everywhere, partially because everyone keeps repeating the mantra that input sanitation is the answer. It isn't. It's dangerous, bug-prone, and it needs to go away. Of course, ...
Mark Buffalo's user avatar
  • 22.6k
11 votes

JSON API response flagged as XSS by vulnerability scanner. Is this a false positive?

An XSS vulnerability usually consists of two components: A backend which reflects user-provided strings without filtering them and a frontend which puts that input into a HTML document without ...
Philipp's user avatar
  • 49.4k
10 votes
Accepted

Passing PHP code directly into JavaScript in HTML5

JSON_HEX_TAG If you are echoing into JS inside a HTML document (as you are in your example), this is necesarry or you risk opening up a huge XSS vulnerability. Without this one, an attacker can post ...
Anders's user avatar
  • 65.6k
9 votes

What is the file signature for a .json file?

JSON (nominally) doesn't have a file signature. File signatures (usually "magic" byte sequences with given offsets) exist in binary file formats; this includes executables, images, video, music, ...
Jules's user avatar
  • 1,250
9 votes

XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?

Making inputs safe is better done as late as possible. That is, when data is output to the page. Globally "sanitizing" input data is bad because it is impossible to distinguish between good data and ...
SilverlightFox's user avatar
8 votes

Why JSON Hijacking attack doesn't work in modern browsers? How was it fixed?

The JSON issue that led google to prepend while was a same-origin breakdown in early versions of firefox (1.5 and 2b specifically) where the JSON file could be loaded as a normal script tag from off-...
dandavis's user avatar
  • 2,693
8 votes

CSRF with JSON POST when Content-Type must be application/json

Warning: This answer may be wrong and to optimistic. See 1lastBr3ath's answer above (concerning flash) and jub0bs comment below (concerning a clever workaround). No, I don't think the application is ...
Anders's user avatar
  • 65.6k
8 votes

Why would I ever use AES-256-CBC if AES-256-GCM is more secure?

Answer is written in 2018. Simply put - CBC came first. It is possible that you might have systems that only support CBC. This would be the same question as "Why would I ever use RC4 and MD5 if ...
MikeP's user avatar
  • 1,209
8 votes

Is a backend API server vulnerable to CSRF?

If your API server uses cookies (or HTTP Basic/Digest/Kerberos) for authentication, then you need anti-CSRF measures. Even if you don't expect a web browser to be used with it, somebody could do so (...
CBHacking's user avatar
  • 47.6k
7 votes

Compromised JSON Web Token (JWT) Bearer Token

If you want to be able to revoke previously granted tokens before their expiry date (a valid security concern), you'll need to include a database lookup to that, which negates one of the main ...
Ian Storm Taylor's user avatar
7 votes

How does JTI prevent a JWT from being replayed?

Great question. I think the RFC text is a little confusing. If the JWT is intercepted in some API call, this token can of course be used again and again (unless the application creates one-time-use ...
Jeff's user avatar
  • 71
7 votes
Accepted

Is JSON Hijacking different than JSONP injection?

Is JSON Hijacking different than JSONP injection? Yes, they are different attacks. While JSON hijacking is a threat from the past that's now eliminated in all major browsers, JSONP injection remains ...
Arminius's user avatar
  • 44.7k
6 votes

How does JTI prevent a JWT from being replayed?

How does a JTI prevent a JWT from being replayed? How often should the JTI field be regenerated? On every request? or only when a new token is generated? I believe the answers to these two ...
SilverlightFox's user avatar
6 votes

What is the file signature for a .json file?

Technically there's no such thing like a JSON File. It's just a normal text file containing text in a JSON Format.
Knorke's user avatar
  • 464
6 votes
Accepted

Preventing replay attacks with JWT

I think you need to separate you concerns. Protecting the JWT on the client side is the job of the application using the JWT, not the API. If this line is blurred than you may need to re-engineer you ...
Shane Andrie's user avatar
  • 3,840
5 votes

CSRF and JSON APIs

They are still susceptible in XSS attacks, plain/text JSON enforcement, and if the origin policies aren't set up correctly. It's been answered before on Stack Overflow, but not here really. The answer ...
Robert Mennell's user avatar
5 votes
Accepted

Reflected XSS via JSON executed with Burp, but how to do it in realistic conditions?

The proposed reflective XSS vulnerability is completely and totally unexploitable by modern browsers due to the following content-type: Content-Type: application/json;charset=UTF-8 The content-type ...
rook's user avatar
  • 47.2k
5 votes
Accepted

Can this self-XSS be extended?

It is not normal or acceptable behavior for UI elements to execute user-supplied JavaScript. Although these bugs maybe difficult to exploit, they need to be patched because running malicious ...
rook's user avatar
  • 47.2k
5 votes
Accepted

What is the difference between JWT and encrypting some json manually with AES?

Differences: JWT sends the plaintext and the hmac of it, but you are instead sending the encrypted message JWTs are a standard and have libraries in multiple languages The problem with your system ...
iovoid's user avatar
  • 166
5 votes
Accepted

How do I prevent XSS in direct access to AJAX/JSON APIs?

Setting content-type to plaintext or JSON and not HTML? If the API returns JSON, then you should the content type to application/json. Apart from just being correct, this will also stop any XSS ...
Anders's user avatar
  • 65.6k

Only top scored, non community-wiki answers of a minimum length are eligible