3 ms·
Yes, but that gets passed to the server.
by airza 9y ago
Yes, but that gets passed to the server.
- sbarre 9y agoIt may get logged by the server but if it's designed to be parsed client-side, there may not be any server-side code examining or sanitizing that value before the SPA gets to it.
- ghayes 9y agoWhat about httsp://example.com/login#vulnerable-fragment
- airza 9y agoYes, as i commented elsewhere in this thread that would be fine.