Tickets :: Comment on [#2565] Firefox 3 bookmarks extension

* Your Email Address
* Spam protection	Enter the letters below: .___.___..__ . ..__ [__ _/ [__)\|\ \|[__) [___./__.\| \\| \\|[__)
Comment	> I remembered that the browser is caching the HTTP Basic credentials, > which is bad. I think I can prevent that. I'm hoping after the > first call using Basic auth, the cookie I get will be enough. > > > > But I think I see now how it's exploitable. Couldn't someone > automatically submit a FORM with a POST to Horde, and the auth cookie > would attach to the request regardless of the domain of the POSTing > site? I guess they may not be able to do much with the response, but > just sending is enough to do nasty things. > > > > So you're suggesting my extension holds a unique, opaque session key > (probably in addition to the cookie I already have) that isn't stored > anywhere in the browser proper? > > > > Also, is this really specific to JSON-RPC, or is it something that > could be a problem with any of the RPC methods? Because on second > thought, I think JSON-RPC requests would be difficult to forge > because XHR is probably protected enough, and they can't be done by > FORM that I know of, because they aren't sent using the standard URL > encoding form. They use a POST Content-Type of 'application/json' or > something, and the body is straight JSON, not wrapped in URL > &key=value form. > > > > I hope it makes sense what I'm getting at here!
Attachment
Watch this ticket