4 ms·
So don’t allow GET with query params. You want the static moniker? It has to be static. No server interaction after load, and no sending any data during load.
by outericky 5y ago
So don’t allow GET with query params. You want the static moniker? It has to be static. No server interaction after load, and no sending any data during load.
- city41 5y agoYou can still hide the data in "folders". /foo/bar/baz/buz can be totally dynamic on the server.
- ericfrederich 5y agoHow about after load, that tab automatically goes completely offline. Users can manually do this in Chrome on a tab by tab basis by using developer console and setting Throttling to "Offline"
- richthegeek 5y agoNote that the "offline" mode in devtools doesn't kill any websocket connections. It may have other holes i'm not aware of also.
- city41 5y agoThat sounds more promising. The site might be able to store data and then send it the next time the page is loaded. I think at the end of the day, a malicious dev could probably find a workaround to most implementations. Might just be better to vet out sites and use reputation to state they are truly offline.
- ericfrederich 5y agoI hear what you're saying, but I also believe this to be a solvable problem
- codethief 5y agoOr in the subdomain, using "DNS exfiltration": https://twitter.com/rsobers/status/1293539543115862016 https://twitter.com/rsobers/status/1293539543115862016
- city41 5y agoThat's an interesting exploit, thanks for sharing.