User winhowes

8 votes

2 answers

4k views

Restrict JS in SVGs

asked Jan 12, 2018 at 8:16

4 votes

1 answer

1k views

When would I use the origin header vs SameSite directive vs csrf token for CSRF defense

asked Dec 14, 2017 at 23:25

3 votes

1 answer

1k views

Force https without 301

asked Jun 10, 2015 at 12:47

3 votes

3 answers

974 views

CSP reporting to another origin

asked Dec 2, 2016 at 2:07

1 vote

2 answers

482 views

Isn't oAuth weaker than traditional passwords

asked Jan 30, 2016 at 21:15

1 vote

2 answers

577 views

XSS outside of the DOM

asked Feb 3, 2015 at 22:59

0 votes

1 answer

260 views

Spoofing Login with facebook from another app

asked May 3, 2017 at 1:40

0 votes

0 answers

135 views

Origin CSRF check fails on page load

asked Feb 2, 2018 at 7:34

0 votes

2 answers

403 views

CSRF on inter-app communication iOS

asked Jul 23, 2019 at 0:40

0 votes

0 answers

76 views

Load url from CSS applied to element outside DOM

asked Apr 11, 2022 at 18:14

Stack Exchange Network

10 Questions

Restrict JS in SVGs

When would I use the origin header vs SameSite directive vs csrf token for CSRF defense

Force https without 301

CSP reporting to another origin

Isn't oAuth weaker than traditional passwords

XSS outside of the DOM

Spoofing Login with facebook from another app

Origin CSRF check fails on page load

CSRF on inter-app communication iOS

Load url from CSS applied to element outside DOM