3 ms·
I'm guessing it's this: http://forum.37signals.com/basecamp/forums/5/topics/3155 http://forum.37signals.com/basecamp/forums/5/topics/3155 Suppose we're both b
by gizmo 18y ago
I'm guessing it's this:
http://forum.37signals.com/basecamp/forums/5/topics/3155 http://forum.37signals.com/basecamp/forums/5/topics/3155
Suppose we're both basecamp users. It may be possible for me to steal your session by giving you a link to a shared calendar or something with malicious javascript. Or I can steal the login cookie of one of the admins by luring them to my website with a support request.
I don't think permitting XSS is a good idea in a shared environment.
- andreyf 18y agoYou can steal cookies with XSS?
- gizmo 18y agoIn some situations. See: http://jehiah.cz/archive/xss-stealing-cookies-101 http://jehiah.cz/archive/xss-stealing-cookies-101
- andreyf 18y agodocument.cookie, wow... Guess you learn something new every day. For those interested, this has a good explanation: http://www.quirksmode.org/js/cookies.html http://www.quirksmode.org/js/cookies.html
- simonw 18y agoYes. That's why XSS is such a serious security problem. And even if you can't steal cookies, you can still do nasty things like re-target the login form's action to point at your own server and hence steal people's passwords.
- jonknee 18y agoApparently they consider XSS a feature. That's a first!
- tptacek 18y agoNope. That's not it.