4 ms·

Anatomy of a Subtle JSON Vulnerability

• teej 18y ago
  Subtle? It's called Cross-Site Scripting and it's pretty well known. Hell, the Wikipedia entry (http://en.wikipedia.org/wiki/Cross-site_scripting#Cookie_security http://en.wikipedia.org/wiki/Cross-site_scripting#Cookie_sec...) even has some tips on how to secure against this particular case.
  • chrisbroadfoot 18y ago
    Actually, this is CSRF (and it's pretty smart - smarter than your average XSS attack).
    • blasdel 18y ago
      script src-ing the JSON document is pretty clever. It could be totally stopped by using a nonce in a header. You should already have implemented a nonce system for form submissions anyway.
• deleted 18y ago
  [deleted]
• waynep 18y ago
  JSON is not insecure, technically it's the browser here.