3 ms·
... and causes another security issue in the process, namely the ability to steal session credentials after an XSS attack. Trading in one security issue for an
by joepie91_ 10y ago
... and causes another security issue in the process, namely the ability to steal session credentials after an XSS attack.
Trading in one security issue for another makes no sense. Just implement the correct mitigation against CSRF attacks; namely, CSRF tokens.
- andy_ppp 10y agoYes but you can now concentrate make yourself XSS proof right; with an XSS you can still get someones cookies... unless you are talking HttpOnly. But we are probably talking single page webapps here anyway.
- CiPHPerCoder 10y ago> unless you are talking HttpOnly Which is precisely what the blog post that was hyperlinked in the sentence you were responding to was advocating.
- andy_ppp 10y agoIf there are no XSS attacks against ReactJS then both ways protect me from both CSRF and XSS right? If you can show ReactJS XSS then I may need to reconsider.