11–20 of 120 posts
Firebug v2 and ChromeTools know how to parse such JSON and ignore that first part. (IE11 and Firefox newer DevTools can't "handle" it aka show just a plain text string)
Around 90 something percent of websites I visit don't implement that `for(;;)` or `while(1)` solution.
So are we saying that they're vulnerable sites?
FB prepends a "for(;;);" which is 1 char shorter than "while(1);", has been the case since 2012/13. Firebug v2 and ChromeTools know how to parse such JSON and ignore that first part. (IE11 and Firefox newer DevTools can't "handle" it aka show just a plain text string)
Why don't browsers strip cookies when they are doing cross domain javascript fetches?
I wondered the same thing years ago. I always thought that browsers would have implemented other security measures so that websites avoid doing this. Around 90 something percent of websites I visit don't implement that `for(;;)` or `while(1)` solution. So are we saying that they're vulnerable sites?
I wondered the same thing years ago. I always thought that browsers would have implemented other security measures so that websites avoid doing this. Around 90 something percent of websites I visit don't implement that `for(;;)` or `while(1)` solution. So are we saying that they're vulnerable sites?
Why don't browsers strip cookies when they are doing cross domain javascript fetches?
Because that's the way internet works and breaking it means breaking a lot of websites. Web security wasn't thought carefully when web was built, it's just a bunch of dirty hacks around most obvious vulnerabilities.
Define httpsb:// do be like https://, but any site may make ajax and similar requests to it (without credentials). Then make some kind of exception (like csrf protection), or use legacy https, in case you need to send cookies.
I wondered the same thing years ago. I always thought that browsers would have implemented other security measures so that websites avoid doing this. Around 90 something percent of websites I visit don't implement that `for(;;)` or `while(1)` solution. So are we saying that they're vulnerable sites?
We are saying that they're vulnerable for THAT particular issue (the JSON hijacking), and that is only if they don't already have some other way of dealing with it.
FB prepends a "for(;;);" which is 1 char shorter than "while(1);", has been the case since 2012/13. Firebug v2 and ChromeTools know how to parse such JSON and ignore that first part. (IE11 and Firefox newer DevTools can't "handle" it aka show just a plain text string)
Why does it have to be a loop, couldn't you make a reliable syntax error in less than 8 characters?