3 ms·
Yes, but not to do the kind of attack simonw is thinking about. You can't set the header from Javascript or HTML. You can forge it from older versions of Flash,
by bdr 19y ago
Yes, but not to do the kind of attack simonw is thinking about. You can't set the header from Javascript or HTML. You can forge it from older versions of Flash, but Flash 9 has enough penetration now that it's safe.
- rms 19y agoSo what's to stop an attacker from downloading an old version of flash?
- deleted 19y ago[deleted]
- bdr 19y agoOnly browsers with an old version of Flash installed can be tricked into executing a forged cross-site request. The attacker wouldn't gain anything by installing it on their own machine.