Government, IT and Workshop - Information Management Today

Search:

DAY

WEEK

MONTH

YEAR

Select your country:
Sign up | Log in

tag cookies

Government

Workshop

Subresource Integrity and Upgrade-Insecure-Requests are Now Supported in Microsoft Edge

Troy Hunt

MAY 1, 2018

Cross site request forgery is a perfect example; here we have a situation where the browser will happily send cookies along with requests (including auth cookies) thus issuing said request under the identity of the logged in user. And yes, "same-site" cookies will fix this but as of today, only Chrome supports it.).

IT Security Government

The JavaScript Supply Chain Paradox: SRI, CSP and Trust in Third Party Libraries

Troy Hunt

FEBRUARY 11, 2018

This tag was in the source code over at secure.donaldjtrump.com/donate-homepage yet it was pulling script directly off Igor Escobar's GitHub repository for the project. Modify the DOM, redirect the user, load in external content, challenge visitors to install software, add a key logger and grab any non- HTTP only cookies. Until now.

Libraries

Libraries Risk Government IT

Subresource Integrity and Upgrade-Insecure-Requests are Now Supported in Microsoft Edge

The JavaScript Supply Chain Paradox: SRI, CSP and Trust in Third Party Libraries

Stay Connected