5 ms·
I've tested many web applications, and around 80% of all applications I've tested contained an XSS of some sort or another, that number drops to around 40% if y
by SCHiM 10y ago
I've tested many web applications, and around 80% of all applications I've tested contained an XSS of some sort or another, that number drops to around 40% if you only look at stored XSS & XSS in a get request. And to less than 10% when only looking at stored XSS.
Unless you've used cookies with the HttpOnly flag XSS trivially escalates to session stealing. Do NOT store sessions in anything other than cookies with the HttpOnly (and really, SecureFlag) flag set.
Using javascript to manage your sessions only the client side in any way is NOT secure.
- mwpmaybe 10y ago> Using javascript to manage your sessions only the client side in any way is NOT secure. And yet it's common practice, at least in the SPA communities with which I engage on a regular basis.
- jupenur 10y ago> Unless you've used cookies with the HttpOnly flag XSS trivially escalates to session stealing Then again you could just use CSP and mitigate almost 100% of those XSS cases. Yes, even most of the stored ones. And with JWT + JavaScript you don't have to worry about all the oddities in the way cookies work, which is a huge plus.
- merb 10y agoif you are vulnerable to XSS your HttpOnly cookie won't help you.
- SCHiM 10y agoYou are wrong. It does. It keeps your user's session from being trivially stolen. In practise this makes successfully executing attacks harder. It's not a _nice_ thing to have, it's essential. An example of this is an application that asks you to confirm <action> after a POST or w/e. If your XSS vector is not in the new page, then you can't execute <action> as an attacker automatically. Many, many, applications (not only on the web) implement such a scheme. A stolen session is MUCH more valuable to an attacker than only a raw XSS.
- tptacek 10y agoIt does not. It is the difference between an exploit that yields a root password and one that yields a shell at uid=0. HttpOnly is almost totally cosmetic.
- SCHiM 10y agoIt's not the same, an XSS is not comparable to a shell for the exact reason I outlined above. And a session is not a password. I'm probably coming over as too offensive, but you really really don't seem to know what you are even talking about. You are wrong wrong wrong.
- tptacek 10y agoI'm pretty sure? I do know what I'm talking about here. Sorry. HttpOnly is a joke.
- kkl 10y agoIf you don't believe `tptacek maybe you will believe James Kettle: http://blog.portswigger.net/2016/05/web-storage-lesser-evil-for-session.html http://blog.portswigger.net/2016/05/web-storage-lesser-evil-...