3 ms·
Could you clarify what actually can be done by this? From what I can see, you can't do XSS because it's escaped. I guess there's the chance that you could do C
by antihero 13y ago
Could you clarify what actually can be done by this? From what I can see, you can't do XSS because it's escaped.
I guess there's the chance that you could do CSRF because you've essentially "set" their CSRF token?
- homakov 13y agoXSS? unrelated here I think. Exactly, cookie forcing/tossing = "set" their CSRF token