Record · corpus.blog/posts/01a0bb99-e0bb-70ef-840d-cf9b8d6c45d8

XSS doesn’t have to be game over

neilmadden.blog · published 10 December 2020

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at neilmadden.blog Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 26
Words captured: 1,513

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://portswigger.net/web-security/cross-site-scripting

portswigger.net

https://mailarchive.ietf.org/arch/msg/oauth/M2mc6BaHQyeOHajUVpVrAREr9nk/

mailarchive.ietf.org

https://blog.codinghorror.com/protecting-your-cookies-httponly/

blog.codinghorror.com

https://beefproject.com

beefproject.com

https://owasp.org/www-community/attacks/csrf

owasp.org

https://livebook.manning.com/book/api-security-in-action/chapter-5/v-11/181

livebook.manning.com

https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html

cheatsheetseries.owasp.org

https://neilmadden.blog/wp-content/uploads/2020/12/ch05_fig5.6_xss_proxying.png

neilmadden.blog

https://tools.ietf.org/html/draft-fett-oauth-dpop-04

tools.ietf.org

https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Using_web_workers

developer.mozilla.org

https://mailarchive.ietf.org/arch/msg/oauth/kH3tyrjz18d1yL3PUxjDmn8Ic20/

mailarchive.ietf.org

https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS

owasp.org

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

developer.mozilla.org

https://web.dev/trusted-types/

web.dev

Macaroon access tokens for OAuth: Part 2 – transactional auth Read at the source ↗

neilmadden.blog

https://www.obdev.at/products/littlesnitch/index.html

obdev.at

https://en.wikipedia.org/wiki/Confused_deputy_problem

en.wikipedia.org

https://livebook.manning.com/book/api-security-in-action/chapter-9/v-11/9

livebook.manning.com

Can you ever (safely) include credentials in a URL? Read at the source ↗

neilmadden.blog

https://srl.cs.jhu.edu/pubs/SRL2003-02.pdf

srl.cs.jhu.edu

HATEOAS Driven REST APIs Read at the source ↗

restfulapi.net

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Closures

developer.mozilla.org

https://medium.com/agoric/ses-securing-javascript-in-the-real-world-4f309e6b66a6

medium.com

Least privilege with less effort: Macaroon access tokens in AM 7.0 Read at the source ↗

neilmadden.blog

https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy

developer.mozilla.org

http://waterken.sourceforge.net/web-key/

waterken.sourceforge.net