What is an XSS attack ?

[mihai11]

Hi,



Can somebody give me an example ? Everybody seems so concerned about such attacks: there are new VB versions because old ones are vulnerable to such an attack.

What I can think of is that a user inserts some "bad" JavaScript code in a post and that code gets executed each time a user sees that thread. Is this an XSS attack ?



Regards,
Razvan M.

[Kier]

It's exactly that.

The 'bad' javascript could redirect the user to another page containing more nastiness, or attempt to steal the user's cookies. The cookie problem has all but gone away with recent versions of vBulletin, since we implemented HTTP-Only cookies in an early vBulletin 3.6 version, but there's always a possibility that something wierd could happen.

[mihai11]

It's exactly that.

The 'bad' javascript could redirect the user to another page containing more nastiness, or attempt to steal the user's cookies. The cookie problem has all but gone away with recent versions of vBulletin, since we implemented HTTP-Only cookies in an early vBulletin 3.6 version, but there's always a possibility that something wierd could happen.

What is a HTTP-only cookie ? Please give me a few hints - maybe a link about this I mean what is the difference between a normal cookie and a "HTTP-only" cookie ?

I am interested in web programming. This "HTTP-only cookie" sounds like good practice.

[Floris]

Wikip! http://en.wikipedia.org/wiki/Cross_site_scripting

Check php.net for the details http://uk.php.net/manual/en/function.setcookie.php

[mihai11]

Check php.net for the details http://uk.php.net/manual/en/function.setcookie.php

I know this function. But what have you changed in the 3.6.X branch so that the cookies become more secure ?

[Colin F]

We've started using the $httponly variable listed there.
As per that page:

When TRUE the cookie will be made accessible only through the HTTP protocol. This means that the cookie won't be accessible by scripting languages, such as JavaScript. This setting can effectly help to reduce identity theft through XSS attacks (although it is not supported by all browsers). Added in PHP 5.2.0.

[mihai11]

We've started using the $httponly variable listed there.
As per that page:

SUPER ! This is what I was asking for. Thanks.