Slashdot Mirror

← Back to Stories (view on slashdot.org)

Cross Site Cooking

Posted by Hemos on from the boning-up-on-the-bad-stuff dept.

Liudvikas Bukys writes "Michal Zalewski identifies a new class of attacks on users of web applications, dubbed Cross Site Cooking. Various browsers' implementations of restrictions on where cookies come from and where they're sent are weaker than you think. Web applications that depend on the browser enforcing much will offer many opportunities for mischief."

1 of 125 comments (clear)

  1. Re:No site should trust client-side information. by zcat_NZ · · Score: 0, Redundant

    God God.

    We don't have Trusted Computing, and hopefully we never will. Everything sent by the client can be modified, tampered with, or stuffed with bogus data. Trust no-one. Verify everything. And don't store anything client-side other than a randomly generated number that tells you who to look up in your server-side database.

    --
    455fe10422ca29c4933f95052b792ab2