3 ms·
The problem is that www.victim.com/evil.js doesn't exist, and never did, but your browser won't know that if it is in it's cache -- this gives you a way of faki
by CJefferson 11y ago
The problem is that www.victim.com/evil.js doesn't exist, and never did, but your browser won't know that if it is in it's cache -- this gives you a way of faking files existing on other servers at the URL of your choices, and as long as they are in the cache you'll get away with it.
- realusername 11y agoOh I see ! I actually did not consider this case. This requires indeed more reflection than I initially thought. Edit: But if we only make the global cache work on the same domain, this problem should disapear completely (it's obviously not as powerfull then but still a massive improvement to the current system)
- jacobr1 11y ago> still a massive improvement to the current system How so? Browsers have had caches for consistent URIs for some time now.
- realusername 11y agoYes sure it works but it's still domain based. The browser is still downloading the same copy of jquery 100s of times during a browsing session.