Google made a web Excelerator extension a couple of years ago, probably more like 10 years ago. What it would do is it would follow URLs so that it could pre-save them if you decided to click on them. The problem was with admin‘s were also using this for their database software like PHP my admin. And unfortunately software like that was changing state of the database from get requests. A lot of people lost a lot of data. Google pulled the extension soon after.

The idea is that you could maybe load an iFrame with personal data first, then perform the logout/Login, get XSS on the domain and now you are allowed to access the old iFrame that contains secret data because it was loaded from the old session

An access token passed as a header could serve as a CSRF token.

Same Question !!

I think you are able to see it because browser didn't sent any cookies along with the request so no private info is given. If you try to open the link another context is created this is completely different scenario. If you open reddit.com reddit will make the request for images and everything for you. so requests to reddit will go with cookies but imgur requests have to go without any cookies. Edit: Doing some research I found out that if you make a request to imgur "i.imgur.com/xReW1yH.jpg" in the response header you get Allow-Access-Control-Allow-Origin which basically tells the browser to stop being paranoid let the origin access the webpage.

+Abiral Shrestha how am I supposed to do that? :D they are so much work and at some point I have to study and earn money.

@@LiveOverflow find an exploit for that

Also noticed the Don't Hug Me I'm Scared draw, but i wasn't sure.

The XHR will be sent anyway to its destination, even you can't read the HTTP response. It happens because it is another origin, albeit you can reach if it is the same. When you made a request using `XMLHttpRequest.withCredentials`, your origin B need to response with CORS headers (Access-Control-Allow-*), in this case, "Access-Control-Allow-Credentials" to the browser allows the cross-communication without restricting credentials, authorizations headers, and TLS certificates.

Thanks man.

Sure you can do that but using that to actually get a third party site to commit actions not authorised by the user would need you to trick the user into logging into the other site via the proxy. Usually a CSRF attack is instead attempting to perform a confused deputy attack on the browser tricking it into using the users stored credentials (or cookies) for domain2 in order to perform actions at the direction of domain1. For instance if the domain stealyourmoney.com wanted to transfer money from the users paypal account merely using stealyourmoney.com/paypal_proxy.php wont work as the browser will access that URL with the cookies scoped for stealyourmoney.com not paypal.com. Getting the user to log in via your proxy is more of a social engineering attack than a true CSRF since you are ultimately attacking the human vulnerabilities (abusing human naivety, trust, etc) not the technological ones.

You are right, abusing it for logins wont work, but i just wanted to share that info.

sauce, pls

No. You are wrong. 1. Same-origin Policy deems page as "same-origin" conforming the following policies: * Same schema/protocol ("" differs from ""); * Same domain ("example.com" differs from "www.example.com"); * and, same port ("80" differs from "8080") Whereas in Internet Explorer is an exception, the 3rd attribute aforementioned (port) is not a resource required to match. As you have noticed, the Same-origin Policy is a restriction rule to access the resource from a different origin(s). May this isn't explicit, but it includes local files as well. Therefore, the schema "file://" and "chrome://" is such a thing to be considered too. 2. The "HTML tags" are referred to as the Document Object Model (DOM). This DOM is a way to JavaScript reach all elements of the Berners-Lee's Hyper-Text Markup Language (HTML). In the case of developers want to interact with different origins, they can use "document.domain" in JavaScript. Suppose a cross-domain from "account.example.com" and "api.example.com." * current domain: "account.example.com" `document.domain = "example.com" ` * current domain: "api.example.com" `document.domain = "example.com"` If you mention the subdomain on "document.domain" on the root domain, it would won't work. The last thing you must need to understand is: *How "**reddit.com**" accept resources from "**i.imgur.com**"?* So that's where it importance of the "Cross-origin Resource Sharing"(CORS) comes in. When use an XMLHttpRequest object to send a request to a different origin, you may not be able to read the response. However, this request will still arrive at its destination. A way to SOP left you to read the "imgur.com" HTTP response headers or body data from "your-domain.com" with XHR is using CORS headers: Access-Control-Allow-Origin: *.imgur.com (or just "*" to allow all websites) Access-Control-Allow-Methods: POST, GET (you can specify others HTTP methods) Access-Control-Allow-Headers: Origin, Accept, X-Requested-With (or any other headers) * To allow credentials, authorizations headers, and TLS certificates: Access-Control-Allow-Credentials: true This header works in conjunction with `XMLHttpRequest.withCredentials`. Hence, if the request sends credentials and "your-domain.com," return the header, the browser would accept the cross-communication without restricting the web content. Otherwise, it will be ignored by the browser if the CORS preflight request not consent. (developer.mozilla.org/en-US/docs/Glossary/Preflight_request) Now, look at this image and note the "Request URL" and its HTTP "Access-Control-Allow-*" headers: i.imgur.com/mCjU81f.png.

+Christian Fernandez feel free to post the ones you think are interesting for that community ;)

:) well I will be glad but if I post them is not the same :) I do post some times.

+Christian Fernandez reddit user Community guidelines say, that self promotion is bad. And my posts got deleted from other subreddits because of that. So I prefer if people share videos they like :)