4 ms·
Google can probably prevent the information leak via image tags by not using a 302 redirect and instead using a 200 response and a combination of <meta refresh>
by jtokoph 9y ago
Google can probably prevent the information leak via image tags by not using a 302 redirect and instead using a 200 response and a combination of <meta refresh> and JS document.location.
This way, the image tag will always fire the onError
- askmike 9y agonot that hard to replace the image with a function that does an ajax call and checks response code.
- twiss 9y agoYou can't read the response of cross-origin ajax requests unless the response specifically allows it (with CORS).
- TomAnthony 9y agoMy suggestion was simply that they add a has to go with the email parameter (since they generated the URL), such that you can't just check against an email (and you can't generate the hash). The scope of the issue is limited, but the fix also does not seem that hard. However, I appreciate it is easy to throw out such an idea, and the reality of implementing it is probably a bit harder. :)