4 ms·
also #fragments aren't sent to the server at all, unless this changes that (a major major change if so)
by liveoneggs 7y ago
also #fragments aren't sent to the server at all, unless this changes that (a major major change if so)
- tln 7y agoRight on. This article is bull
- deleted 7y ago[deleted]
- amsully 7y agoThe google document being used talks about crossing an origin-boundary. So website with bad script injected is loaded by the user and is able to make requests to a logged-in banking website with time-based/scrolling attacks.
- falcolas 7y agoDoes this matter when the server (well, multiple servers when you throw in ads as well) are running their custom Javascript on the client, which has access to not only the viewport coordinates, but the URL itself?
- liveoneggs 7y agodoes this add an additional vector to that case?