3 ms·
It's not just your site: an HTTP site allows for injecting HTTP urls for images/css files on other sites, e.g. <link src="http://target.site/..."> If target
by Beldin 4y ago
It's not just your site: an HTTP site allows for injecting HTTP urls for images/css files on other sites, e.g.
<link src="http://target.site/...">
If target.site's auth or session cookies aren't properly protected, this is sufficient for stealing them [1].
And plenty of sites have insufficient protection on their cookies [1].
[1] http://www.open.ou.nl/hjo/papers/compsec21.pdf http://www.open.ou.nl/hjo/papers/compsec21.pdf
- forgotmypw17 4y agoThanks for the paper link. There are risks and there are benefits. Managing the risks to get the benefits is the game. My sites only use cookies for user preferences preferences and client-linked session tokens, so I am not too worried. A different way to mitigate the risks is by only storing information that does not need to be private, remaining small and un-interesting, designing for transparency and auditability, and keeping a close eye on those audit logs.