4 ms·
I'm surprised that nobody included "clicking on the url bar in order to modify it" as a mitigation.
by enedil 7y ago
I'm surprised that nobody included "clicking on the url bar in order to modify it" as a mitigation.
- jamesfisher 7y agoIn principle, it's not a mitigation - I was just too lazy to forge an interactive URL bar! You could make one which acts just like the Chrome URL bar, but e.g. acts as a MITM.
- jannotti 7y agoAt first I though you wouldn't be able to stay "in the middle" because you'd have to redirect to the typed address. You can't AJAX it in, because of CORS. But you could go to your own host and have your server sit in the middle. The user wouldn't be logged in, since cookies wouldn't be sent. But maybe they would login through your proxy.
- delfinom 7y agoYou can simulate that though since it's an html element being rendered with css.