Skip to main content
Share Your Experience: Take the 2024 Developer Survey
12 votes

Is storing authentication tokens in local storage with a strong CSP safe?

... prohibits all JS except the one I bundle my app, XSS attacks should be essentially impossible This assumes that your (trusted) JS is free from exploitable bugs. ... is there still a security ...
Steffen Ullrich's user avatar
8 votes
Accepted

HTTPonly token without CSRF is safe?

There are several ways, but these ones are especially relevant to your question: XSS (Cross-Site Scripting) for remote control. The HttpOnly flag only prevents script from reading the cookie; it does ...
CBHacking's user avatar
  • 48.9k
7 votes
Accepted

Why can't we close some tags for cross site scripting purposes?

Assuming the XSS isn't firing, the problem is that you're looking at the processed HTML, not the raw page source. This usually happens if you're using the browser developer tools - rather than the &...
CBHacking's user avatar
  • 48.9k
6 votes

Is storing authentication tokens in local storage with a strong CSP safe?

I would not place that much trust in CSP to be honest. I'm currently trying to tighten the CSP headers on a reasonably complex project. Some issues I'd worry about: Third party components may require ...
marcelm's user avatar
  • 1,008
5 votes

Does CSP protect against XSS in url?

Browsers do not magically execute JavaScript code embedded in the URL path. By itself, the path is just data. If the code from your example is executed, there's a fundamental problem either in the ...
Ja1024's user avatar
  • 7,466
4 votes

Is storing authentication tokens in local storage with a strong CSP safe?

Assuming that you set a strong Content Security Policy, is there still a security advantage of storing credentials/sessions in cookies over local storage? The advantage isn't that significant to ...
tim's user avatar
  • 29.6k
3 votes

HTTPonly token without CSRF is safe?

CSRF attacks don't require JavaScript access to the session ID. In fact, they are typically performed from other sites (hence the name Cross-Site Request Forgery) which are already blocked from ...
Ja1024's user avatar
  • 7,466
3 votes

Preventing HTTP requests containing XSS in nodeJS

Cross-site scripting is an output problem, not an input problem. It happens when data is not correctly escaped before using it in an HTML context, or when non-HTML data (e.g., plaintext) is ...
Ja1024's user avatar
  • 7,466
3 votes
Accepted

How to sanitize $_SERVER url variables?

This approach doesn't make sense. Cross-site scripting is an output problem, not an input problem. The vulnerability consists of inserting a string (which currently happens to be the referrer header) ...
Ja1024's user avatar
  • 7,466
2 votes
Accepted

Using window.open('',"_blank") can this be XSS exploited?

It sounds like there are two concerns here: Is this example vulnerable to XSS? And is it vulnerable in a way that poses a legitimate security concern? To answer question one, your example is ...
Macrozamia's user avatar
2 votes
Accepted

XSS in document.write(location.href)

Internet Explorer and possibly other old browsers might be vulnerable to this attack. In modern browsers, the URL-encoding of special characters within location.href effectively acts as HTML-escaping, ...
Ja1024's user avatar
  • 7,466
2 votes

is a stored xss possible if user input is not saved?

I prefer the term "persistent" to "stored" simply because stored can be blurry as payloads can persist outside the traditional notion of storage. Does a reflected xss injected ...
wireghoul's user avatar
  • 5,959
2 votes
Accepted

Simple XSS Example Involving AJAX not Firing

Double checking the documentation I found no evidence that the .text() method performs any sanitization, and neither is there any automatic sanitization by the reading of the .value property nor by ...
CBHacking's user avatar
  • 48.9k
2 votes
Accepted

CVSS3 score for XSS leading to account takeover

This is not an easy question. IMHO CVSS moved on from a generic, catch-all evaluation of all XSS (it used to be more or less rXSS[] + post-auth pXSS[] = Medium, pre-auth pXSS = High). The examples ...
tim's user avatar
  • 29.6k
2 votes

Secure way to output encoding HTML for insert raw html via javascript

If you want to insert untrusted HTML markup as text, then you should use the textContent property, not innerHTML. The textContent property reliably prevents XSS attacks, because the content is only ...
Ja1024's user avatar
  • 7,466
2 votes

Running blog under /blog, security considerations

From a security perspective, you should definitely run the blog under a subdomain, not a path on the main domain. The same-origin policy isolates the subdomain from the main domain to some degree. ...
Ja1024's user avatar
  • 7,466
1 vote

Is it possible to trick a user into logging in to a site, then stealing a non HttpOnly cookie that will be set after they log in?

My question is whether it's possible to trick the user into logging in One possible way this can be accomplished is with a CSRF attack on the logout functionality. Logout is often not protected from ...
Sjoerd's user avatar
  • 30.8k
1 vote

Is There a way to exploiting / Make exploit scenario for Header based reflected XSS?

One way to exploit this is to combine it with a cache poisoning attack. This happens when a server-side intermediate cache stores your page with the XSS payload, and then serves it to everyone from ...
Sjoerd's user avatar
  • 30.8k
1 vote

is <script>javascript:alert(document.domain); a valid script for xss?

The correct syntax will look something like this <script>alert(document.domain)</script> , since if you do not close the script tag your script will continue to pickup anything that is ...
Aleks4920's user avatar
1 vote
Accepted

Is it safe to store the OIDC token in a private field of a javascript object?

Safe enough, sure, lots of sites do this. An attacker who gets XSS on the site might still be able to extract the token, depending on exactly how the function that adds it to API calls is invoked (for ...
CBHacking's user avatar
  • 48.9k
1 vote

Is this a type of XSS attack?

It depends. The fact that the alert appears before sending means that there's client-side script reading your text input and injecting it into the DOM in some fashion, and doing so insecurely. It is ...
CBHacking's user avatar
  • 48.9k
1 vote

CVSS3 score for XSS leading to account takeover

CVSS3 only takes into consideration the impact to the whole web application, and not just to a single user. Is that so? Admittedly, it's been some time since I read the full CVSS specs and I could ...
SeeYouInDisneyland's user avatar
1 vote
Accepted

Why don't Internet browsers allow me to fetch a JSON file from raw.githubusercontent.com, but they allow me to fetch .psm files from there?

The feature you describe is either Cross-Origin Read Blocking (CORB) or Opaque Response Blocking (ORB). It blocks specific media types like application/json, text/plain and text/html, while other ...
Ja1024's user avatar
  • 7,466
1 vote

With Response header having content-type: application/json, is it still possible to trigger XSS?

The rest of this answer assumes that you have extensive or even complete control over the "JSON" response. That is, you can inject arbitrary characters (in particular HTML meta-characters) ...
CBHacking's user avatar
  • 48.9k
1 vote

XSS in a href with target=_blank

If you open the URL via Mouse trick :) Clicking the middle button of your mouse. (XSS executes on the same domain) Right click, open link in new tab, the XSS will execute. (XSS executes on the new ...
LieberHunter's user avatar
1 vote

What exactly are Hidden HTTP Parameters?

In the context of the linked article, it is not to be confused with HTML <input type="hidden"> elements. Thoses elements contains name value attibutes values: that move to the URI bar ...
v-g's user avatar
  • 316
1 vote

How to exploit publicy known vunerable version of jquery?

Further to Denis's excellent answer it is also worth clarifying that an attacker needs to be able to control the inputs to the vulnerable functions when a "victim's" machine is visiting the ...
El Ronnoco's user avatar
1 vote

Bypassing double quote in DOM based XSS?

In general, no. If you see " getting transformed to &quot; as it passes through the HTML, then that usually means that the application is doing output escaping properly.
Abhishek Morla's user avatar
1 vote

XSS inside anchor tag (<a>) without user interaction?

The onfocus and autofocus trick does not work in <a> tag (correct me if I'm wrong). At least now (2024, 7 years after your question), this is wrong. autofocus is a global attribute, so it also ...
Ricky Sixx's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible