Content deleted Content added
No edit summary |
→Background: Briefly illustrate "URI Scheme" (this is definitely jargon that needs it) |
||
Line 7:
==Background==
Security on the web depends on a variety of mechanisms, including an underlying concept of trust known as the same-origin policy. This essentially states that if content from one site (such as ''<nowiki>https://mybank.example1.com</nowiki>'') is granted permission to access resources (like cookies etc.) on a web browser, then content from any URL with the same (1) [[URI scheme]] (e.g. ftp, http, or https), (2) [[host name]], ''and'' (3) [[port number]] will share these permissions. Content from URLs where any of these three attributes are different will have to be granted permissions separately.<ref>{{cite web |title= Same Origin Policy - Web Security. W3.org. |url= http://www.w3.org/Security/wiki/Same_Origin_Policy |access-date= November 4, 2014 }}</ref>
Cross-site scripting attacks use known vulnerabilities in web-based applications, their servers, or the plug-in systems on which they rely. Exploiting one of these, attackers fold malicious content into the content being delivered from the compromised site. When the resulting combined content arrives at the client-side web browser, it has all been delivered from the trusted source, and thus operates under the permissions granted to that system. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access-privileges to sensitive page content, to session cookies, and to a variety of other information maintained by the browser on behalf of the user. Cross-site scripting attacks are a case of [[code injection]].
| |||