1
vote
2answers
35 views

Read-only cross origin domain request

Is it possible to allow read-only access in a CORS header? I want JS from two websites to be capable of verifying each other, but not altering each other.
2
votes
1answer
432 views

Pass IMG SRC via GET and echo it? Is that really secure?

I was wondering how I can make a really simple GET and echo request more secure The code: $src = $_GET['src']; echo "<img src='$src' />"; Basically, I have a URL like ...
3
votes
1answer
440 views

Is this safe? <a href=http://javascript:…>

I wonder if href and src attributes on <a> and <img> tags are always safe w.r.t. XSS attacks, if they start with http:// or https://. For example, is it possible to append javascript: ... ...