Questions tagged [javascript]

The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

1379 questions
246
votes
11 answers

Why is Math.random() not designed to be cryptographically secure?

The JavaScript Math.random() function is designed to return a single IEEE floating point value n such that 0 ≤ n < 1. It is (or at least should be) widely known that the output is not cryptographically secure. Most modern implementations use the…
forest
  • 68,079
  • 20
  • 223
  • 298
163
votes
4 answers

Why is the same origin policy so important?

I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves it (like Google Analytics code), which means it…
YSY
  • 2,269
  • 4
  • 20
  • 16
130
votes
3 answers

This JavaScript code is injected on my hotel Wi-Fi: should I be worried?

While connected to my hotel Wi-Fi, visiting the URL http://www.google-analytics.com/ga.js results in the following content being served: var ga_exists; if(!ga_exists) { ga_exists = 1; var is_responsive = false; var use_keywords = false;…
foodiddy
  • 1,061
  • 2
  • 8
  • 4
87
votes
5 answers

Can "Accept cookie" button in a website be malicious?

I don't remember when this "accept/cancel cookie" button started to be used in websites. Why do they insist on getting users to click on this button? Can it do any harm to user's PC or to collect any private and sensitive data? Their reason for this…
0_o
  • 1,142
  • 1
  • 9
  • 20
83
votes
10 answers

Why is JavaScript "safe" to run in the browser?

JavaScript has certain limitations such as preventing reading and writing to disk and not allowing access to other browser windows or domains. But is that all that's needed to prevent malicious code from running? JavaScript is pretty powerful, and…
PBeezy
  • 1,741
  • 2
  • 14
  • 11
72
votes
3 answers

Securing a JavaScript Single Page App with RESTful backend

I'm currently in the process of building a JavaScript SPA and have been researching how to secure it. There is currently as RESTful API that is being completely interacted with through AJAX. We also have mobile clients that interact with this API,…
Jon Wingfield
  • 831
  • 1
  • 7
  • 5
71
votes
1 answer

Tell browser my site has no scripts

I have created a Tor hidden service site which has absolutely no JavaScript or other types of client side scripts. The page is HTML, CSS, images, and some JSP for handling user input. I encourage users to use NoScript, however many times users do…
k1308517
  • 1,292
  • 1
  • 15
  • 28
59
votes
6 answers

Anonymous surveys that aren't so anonymous

In the past I have completed an 'anonymous' survey at work only to find that my employer was able to garner a lot of not-anonymous information from this survey. Location, name of manager, etc. None of this information was provided in the survey.…
iShaymus
  • 673
  • 1
  • 5
  • 5
58
votes
3 answers

eBay web site tries to connect to wss://localhost:xxxxx - is this legit or they have some Malware JS running?

In helping a corporate user log on to eBay, I noticed that when on the login page, a stream of errors were coming up in the Firefox JS Console about not being able to connect to wss://localhost . This is a bit concerning, obviously. Why would a web…
ETL
  • 641
  • 1
  • 5
  • 8
53
votes
6 answers

Does injecting querystring values directly into HTML pose a security risk?

Someone reported a bug on my site that I don't really consider an issue. My site has an URL akin to this: www.site.com/ajax/ads.asp?callback=[text injection] So filetype is application/json, and I don't see how that can affect security of site. His…
Daniel
  • 1,452
  • 5
  • 22
  • 32
50
votes
9 answers

How can I ensure my API is only called by my client?

I have an API Key to a paid service. This API is invoked from an unauthenticated page on my site. I am proxying the request to the paid service through my backend server. I have also added CORS on the API to make sure it is called from my site. THe…
Johnny Donalistic
  • 667
  • 1
  • 5
  • 6
49
votes
3 answers

I found obfuscated code in a comment on my blog. What should I do?

Today I was checking comments on my blog and I found a strange comment, here is the exact text <script>var…
Green Fly
  • 1,997
  • 1
  • 16
  • 21
49
votes
2 answers

Magic hash attack in JavaScript

In PHP a magic hash attack happens when loose type comparisons cause completely different values to be evaluated as equal, causing a password "match" without actually knowing the password. Here is an example: <?php if (hash('md5','240610708',false)…
drewiepooey
  • 609
  • 1
  • 5
  • 7
46
votes
3 answers

Why is there no web client for Signal?

I’ve read about E2EE (end to end encryption) of Signal in web clients on a Signal Community discussion forum , and wonder why they say that the browser is insecure for E2EE and native apps are secure. I think the security issues for clients are the…
SeyyedKhandon
  • 577
  • 1
  • 4
  • 7
46
votes
3 answers

For an end-user, is HTML5/JavaScript more secure than Flash?

I’m not talking about server-side security or even necessarily XSS vulnerabilities, as these are attacks on vulnerable services and do not use any pre-existing vulnerabilities on the client side to affect an end user. They will exist as long as web…
Jonathan Gray
  • 1,027
  • 7
  • 11
1
2 3
…
91 92