Acronym for Cross Site Scripting.

learn more… | top users | synonyms

1
vote
2answers
33 views

Cookie security risk between primary domain and a CMS on a subdomain

Without making the question too general, I am looking to discover the specific risks associated with cookies between my primary domain hosting HTML content only, to a subdomain that is hosting ...
1
vote
2answers
39 views

Read-only cross origin domain request

Is it possible to allow read-only access in a CORS header? I want JS from two websites to be capable of verifying each other, but not altering each other.
2
votes
1answer
482 views

Pass IMG SRC via GET and echo it? Is that really secure?

I was wondering how I can make a really simple GET and echo request more secure The code: $src = $_GET['src']; echo "<img src='$src' />"; Basically, I have a URL like ...
3
votes
1answer
514 views

Is this safe? <a href=http://javascript:…>

I wonder if href and src attributes on <a> and <img> tags are always safe w.r.t. XSS attacks, if they start with http:// or https://. For example, is it possible to append javascript: ... ...
2
votes
4answers
215 views

How to explain XSS to common web owner/user?

How would you explain cross-site scripting vulnerability to a non-programmer (common web user)?
10
votes
5answers
2k views

How can I prevent a power user from calling my ajax functions?

I have a site that uses ajax calls to perform a number of functions. They have the webbrowser call back to a script - ajax.php. Though I use post data to transmit the data and limit the commands ...