21–30 of 37 posts
I don't see how the length of time the reset link is valid really has any bearing here. I'm assuming the implication is that an attack could search for old password reset emails but if they have access to the email account, why not just request another reset?
Slick and a nice UI, but the security advice in this is just plain terrible. Blacklist input validation as defense against XSS? Are you kidding me? And then over to session fixation, where I see the exact same ?jessionid=blah example that has been in any Web Security book for the last 10-15 years? Come on!
> Imagine if a user has their email account hacked - the first thing an attacker will do is try to compromise their other online accounts, and long-lived password reset links make this easy. I don't see how the length of time the reset link is valid really has any bearing here. I'm assuming the implication is that an attack could search for old password reset emails but if they have access to the email account, why n…
Slick and a nice UI, but the security advice in this is just plain terrible. Blacklist input validation as defense against XSS? Are you kidding me? And then over to session fixation, where I see the exact same ?jessionid=blah example that has been in any Web Security book for the last 10-15 years? Come on!
Where are you seeing that? The advice I can see talks about escaping HTML rather than blacklisting input validation: https://www.hacksplaining.com/prevention/xss-stored
Unfortunately it doesn't discuss escaping Javascript nor CSS. But it least it covers the most common case.