4 ms·
Already exists. Custom HTTP Header with a JWT token for example. Also in the body of a post request can be the auth data. In the URL would also be possible but
by kenniskrag 6y ago
Already exists. Custom HTTP Header with a JWT token for example. Also in the body of a post request can be the auth data. In the URL would also be possible but is a security risk due to e.g. browser history.
- kenniskrag 6y agoadvertisment still works, because the site can just execute a js and make a post request to the advertisment company.
- deleted 6y ago[deleted]
- tester34 6y agoYou have to attach that "JWT token" (heh) with e.g JS which makes it vulnerable to XSS, doesn't it?
- kenniskrag 6y agoWith xss you can also inject the code. So no cookie extraction needed imho.