#Csrf
2 notas · última:
Full Stack Security Essentials: Preventing CSRF, Clickjacking, and Ensuring Content Integrity in JavaScript
The article covers CSRF, clickjacking, and content integrity in JavaScript, with prevention tips for Node.js and the browser, including tokens, headers, CSP, and SRI.
Cross-Site WebSocket Hijacking (CSWSH)
The article describes how WebSocket handshakes can carry cookies or HTTP authentication cross-site, allowing an attacker to open an authenticated connection, read data, and send messages unless the server checks Origin or uses tokens.