3 ms·
you have to be logged in for the request to work right?. if you are not logged in / don't have the cookie / session it won't work. so whats the problem? when yo
by artellectual 13y ago
you have to be logged in for the request to work right?. if you are not logged in / don't have the cookie / session it won't work. so whats the problem? when your logged in you see all that stuff anyway why does it matter which flavor its in?
as long as your session is secured how will this work?
- homakov 13y agoyou make logged in user to visit specially crafted page, where you attack him with cross site <script> tag. and leak the data.
- deleted 13y ago[deleted]