[11588] in www-talk@info.cern.ch
Re: Security: Cookies
daemon@ATHENA.MIT.EDU (Andrew Daviel)
Fri Apr 28 23:22:27 2000
Date: Fri, 28 Apr 2000 18:33:46 -0700 (PDT)
From: Andrew Daviel <andrew@daviel.org>
To: www-talk@w3.org
In-Reply-To: <4.2.2.20000320110209.00d0dd40@imap>
Message-Id: <Pine.LNX.4.10.10004281828480.28189-100000@home.daviel.org>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Resent-From: www-talk@w3.org
An advisory recently about a cookie security problem :
http://www.peacefire.org/security/jscookies/
A site can set a cookie which contains a script, then
open a frame on your cookie file thus executing the script with
the domain of your PC, able to parse HTML files and directories
on your PC.
Cookies were also mentioned in the "cross platform scripting
advisory" - which is really about web forums, chat rooms and
query scripts being able to attack other HTML forms on the same
server.
Andrew Daviel
http://vancouver-webpages.com/andrew
Deniable unless digitally signed.
