3 ms·
The idea is that your browser is running their site, and their site is trying to be malicious and steal your data for a remote site. Your data there can only be
by Jare 8y ago
The idea is that your browser is running their site, and their site is trying to be malicious and steal your data for a remote site. Your data there can only be accessed with your cookies/auth, so they can't just do it by themselves, they need your computer/browser. If they try to request the json via XHR, CORS will deny it. If they try to read it using a <script> tag, they can't access the response before the response runs as a script and hangs at the infinite loop.
- posterboy 8y agoThe catch is that attackers can redefine accessor methods globaly, because those are part of the object system, and do run modified on load, but they cannot redefine "while", which is a built-in, one of the few reserved language key words. At least I hope they can't. Of course that does depend on implementation details.