New answers tagged web-browser
0
votes
CSP: Allow inline scripts while blocking javascript: in iframe src
This is not currently possible.
I created an issue to request it: Possibility to block all javascript: URLs · Issue #658 · w3c/webappsec-csp
- 32.9k
3
votes
Security of an initial redirection from http://example.com to https://example.com
Since the question was asked there is now a solution available to websites.
If the cookie name is prefixed __Secure- or __Host- the browser will ignore any attempts to set the cookie from plain HTTP, ...
- 151
1
vote
What prevents a browser from saving and tracking passwords entered to a site?
Nothing does, and this is why you need an extremely high degree of trust in your browser as well as any other system components (operating system, input methods, etc.) that have access to your inputs ...
1
vote
What prevents a browser from saving and tracking passwords entered to a site?
There is nothing that prevents this. If this is something you are worried about, choose a browser whose source code is publicly available (e.g. Firefox and forks, Chromium), audit the code of the ...
- 159
1
vote
What prevents a browser from saving and tracking passwords entered to a site?
Nothing stops them, but it would be difficult for them to get away with it without being found out. Many paranoid users run monitoring software (e.g. Little Snitch for Macs, OpenSnitch for Linux, ...
- 612
56
votes
Accepted
What prevents a browser from saving and tracking passwords entered to a site?
There's no technical feature which prevents the browser from stealing or misusing website passwords. The browser GUI receives the password as plaintext as soon as you type it in. What does prevent ...
- 17.2k
1
vote
Changing credentials: Should I send the password next to the JWT?
Lets address this step by step.
The advantage seems to be that a stolen JWT doesn't suffice to steal one's identity
I believe the standard requires you to provide the password when changing password/...
- 229
1
vote
Accepted
Changing credentials: Should I send the password next to the JWT?
Yes you should require the users existing password when they change password. This is an ASVS requirement, BTW:
2.1.6 Verify that password change functionality requires the user's current
and new ...
- 468
2
votes
Is it possible that a website is built in such a way that when I upload a pdf to the website, something else in my folder will also be uploaded?
No. Your browser hands over only the file you selected to the website running in your browser window, and only that can be consequentially transferred anywhere.
- 6,274
Top 50 recent answers are included