| |||||||||||||
Mozilla plans for Firefox 3 and beyondMozilla plans for Firefox 3 and beyondPosted Jul 3, 2008 16:46 UTC (Thu) by nix (subscriber, #2304)Parent article: Mozilla plans for Firefox 3 and beyond
OK, so in what way is cross-site XMLHttpRequest not a huge security hole waiting to happen?
(Log in to post comments)
Mozilla plans for Firefox 3 and beyond Posted Jul 4, 2008 18:13 UTC (Fri) by k8to (subscriber, #15413) [Link] It's a good question. One hopes there are some sane limitations placed on it.
Mozilla plans for Firefox 3 and beyond Posted Jul 5, 2008 0:47 UTC (Sat) by njs (guest, #40338) [Link] It's hopefully not a huge security hole in that the "cross-site XHR" is actually the "build a security framework that allows cross-site XHR in the cases where it is safe but not in the ones where it isn't" feature. There's a W3C proposal and all that. So that's reassuring, right? I haven't followed the design of this thing myself, and the track record of people trying to build secure stuff on top of the incredibly complex mash that is web technologies doesn't make me terribly confident that they'll manage to get it right... but then again, the web is such a mess security-wise that I'm not sure it's likely to make things much worse. http://developer.mozilla.org/en/docs/Cross-Site_XMLHttpRe...
Mozilla plans for Firefox 3 and beyond Posted Jul 5, 2008 8:57 UTC (Sat) by nix (subscriber, #2304) [Link] Well, that looks less horrible than, say, MS's zones: but I can just feel the edge cases waiting to be missed, leading to XHRs being allowed in cases where they shouldn't be...
|
|||||||||||||