Tag
Research article from PortSwigger demonstrating new XSS attack vectors using JavaScript properties in HTML tag names, enabling WAF bypasses across browsers.
The article discusses the security implications of storing authentication tokens in localStorage versus cookies, emphasizing the risks of XSS attacks and the benefits of using httpOnly cookies for sensitive apps.
The article argues that injection bugs (XSS and SQL injection) should be prevented structurally through output escaping and avoiding the problem entirely, rather than relying solely on input sanitization.
The article explains how a single XSS vulnerability can defeat the phishing-resistance of passkeys when attestation is set to 'none', allowing attackers to register their own passkeys and achieve persistent account takeover. It calls for attention to this overlooked threat and suggests defenses.