Re: FW: Java Script Client
Tony Arcieri <[email protected]>
| Newsgroups | gmane.comp.capabilities.general |
|---|---|
| Message-ID | <CAHOTMVJ1sMP0+q0fT0LVzkRE+eam+V=U-anKsc9k=qO+=Q8SQw@mail.gmail.com> |
On Tue, May 27, 2014 at 11:16 AM, Tony Arcieri <[email protected]> wrote: > It's true it's not a silver bullet. If you can inject a script tag into > the page, and dynamically control the content of a resource on the same > origin such that the browser will interpret it as JavaScript, you can > potentially pull off reflective XSS that way. > I'd also note this sort of attack can be mitigated by using a separate domain for serving scripts, e.g. js.myapp.com, and setting script-src: js.myapp.com. This further reduces the attack surface of malicious scripts to being able to make changes to js.myapp.com. -- Tony Arcieri _______________________________________________ cap-talk mailing list [email protected] http://www.eros-os.org/mailman/listinfo/cap-talk