As CROSS Site Authentication (short: XSA) one designates a computer safety gap with an aggressor the stranger of passwords to spy can.

This gap can be used, if a Web forum, a Web log or similar systems by not trustworthy users permit a merging of pictures. An aggressor merges in addition any picture into a contribution, which is protected by the Web server. If a user calls the contribution, its Webbrowser requests it to enter user/password combination who can be stored then by the Web server of the aggressor.

CROSS Site Authentication can be favoured by the Browser, by this in the password dialogue clearly enough does not indicate the name of the Web server requesting to the password input.

Protection

Complete deactivating of pictures from external source offers a safe protection on the side of the offerer. By clearer dialogues or warning references the Browser could likewise contain the problem.

The safest protection is however in principle attention and distrust in relation to unexpected password dialogues.

Browser, which prevent the Authentikations mechanisms for elements of strange Web servers, embedded into a web page, in principle, offer likewise safe protection. An example for this is Firefox in version 1.5

Related links

• Example side (note: no genuine passwords enter!)
• The CROSS Site Auth (XSA) Attack

Articles in category "CROSS Site Authentication"

We found here 31 articles.

Related Websites

We found here 3 related websites.

• Cross-Site Authentication - Wikipedia
  Als Cross-Site Authentication (kurz: XSA) bezeichnet man eine ... Cross-Site Authentication kann durch den Browser beg


• Like XSS, just simpler and harder to prevent: The Cross Site Auth ...
  And feels good, too: My article on the Cross-Site-Authentication Attack in the German ... Just a quick follow up on my Cross-Site-Authentication Attack: My ...


• Secunia - Advisories - FunkBoard Authentication Bypass and Cross ...
  Secunia - Advisories - FunkBoard Authentication Bypass and Cross-Site Scripting. ... FunkBoard Multiple Cross-Site Scripting Vulnerabilities ...