WebFund 2014W Lecture 21: Difference between revisions

From Soma-notes
Created page with "* Browser security ** content-provider conflict ** click fraud: fraud against advertisers, not ad networks ** facilitated by cross-site scripting vulnerabilities (XSS) ** also..."
 
No edit summary
Line 15: Line 15:
* defenses: SSL, Origin: or Referer: headers
* defenses: SSL, Origin: or Referer: headers


SQL Injection
<tt>SQL Injection</tt>
 
Solution: input sanitization using whitelists when possible.




* HTML5
* HTML5

Revision as of 18:16, 28 March 2014

  • Browser security
    • content-provider conflict
    • click fraud: fraud against advertisers, not ad networks
    • facilitated by cross-site scripting vulnerabilities (XSS)
    • also, cross-site request forgery (XSRF or CSRF)

XSS is just adding JavaScript to a page when you shouldn't be able to (from user-generated content).

XSRF is "confused deputy"

  • one tab: malware.com
  • another tab: bank.com, logged in
  • bank has RESTful API (e.g., POST, GET) for money transfers
  • what if malware.com does the same money transfer POST?
    • how can the bank server tell the difference?
  • defenses: SSL, Origin: or Referer: headers

SQL Injection

Solution: input sanitization using whitelists when possible.


  • HTML5