Web Development
Session vs cookies; XSRF/CSRF, XSS attacks. Links: video on CSRF
29 flashcards · Computer Science · by lakesare
What happens after one types in a URL in browser and presses enter (apart from DNS query)?
Browser checks if the domain is in its DNS cache. If not found, the browser calls gethostbyname library function to do the lookup, it goes to DNS server. Once server IP is known, browser initiates a TCP connection to server on port 80. HTTP request is sent, client receives response from server. TCP connection closes. Links: DNS cache in chrome: chrome://net-internals/#dns
What's a session?
Server keeps some user-associated data server-side from request to request (using cookies).
Session VS session cookie?
Session is information stored on server and connected to each user by some sessionId cookie, either session or persistent. Session cookie is a cookie that doesn't have an expires attribute, which makes it be deleted by browser when it closes.
How can cookies be set?
by Js from browser (unless the cookie's HttpOnly flag is set) by server using a Set-Cookie header
What's meant by a cookie?
HTTP header Cookie. Browser, as a response to some request, sends: HTTP/1.0 200 OK Content-type: text/html Set-Cookie: theme=light Set-Cookie: sessionToken=abc123; Expires=Wed, 09 Jun 2021 10:18:14 GMT And on the next request browser will automatically send this to server: GET /spec.html HTTP/1.1 Host: www.example.org Cookie: theme=light; sessionToken=abc123 …
Name 2 ways to store session on server.
Set-Cookie: sessionId=432, and keep a database table sessions: sessionId, sessionData Set-Cookie: _Hello_session=<encrypted user_id=3>--<digital signature>, and use some secret_key to decrypt and verify a cookie on server
XML vs XHTML vs HTML4 vs HTML5?
XML - is a syntax definition, any tags are possible, it's very strict. XML is used for data transfer, like JSON. XHTML - was developed as a less lenient HTML4. It used HTML tags, but uses strict XML syntax. XHTML being too unforgiving never caught on, when the time came to devise a new standard, the W3C decided to support HTML5 rather than XHTML. XML and HTML were designed with different goals: XML was designed to carry data - with focus on what data is HTML was designed to display data - with…
XML used to be used for data transfer (like JSON).
<?xml version="1.0" encoding="UTF-8"?> <note> <to>Tove</to> <from>Jani</from> <heading>Reminder</heading> <body>Don't forget me this weekend!</body> </note>
When will script be fetched and executed? <html> <head> ... </head> <body> ... <script src="script.js"></script> .... </body> </html>
HTML parsing stops script fetched script executed HTML parsing continues
When will script be fetched and executed? <script async src="script.js"></script>
script fetched while HTML parses HTML parsing stops script executed HTML parsing continues
When will script be fetched and executed? <script defer src="script.js"></script>
script fetched while HTML parses script executed after HTML has been parsed
What does a HEAD HTTP request return?
Response identical to the one that would correspond to a GET request, but without the response body.
var script = document.createElement('script'); t.src = "//somebozoadservice.com/ad-tracker.js"; document.getElementsByTagName('head')[0].appendChild(script); When will this script execute?
Dynamically added script tags are executed by default as async. So script will load in parallel, and then, after loading, will immediately be executed.
What is resource hints?
<a rel=""> tag attribute that tells browser to prefetch some resource. Links: extensive article on web performance and resource hints
Give 2 examples of resource hints.
Prerender: <link rel="prerender" href="http://cdn.com"> Will actually cause the browser to get the linked href page and render it before the user even clicks the anchor. Preconnect: <link rel="preconnect" href="http://cdn.com"> Tells the browser to open a connection as soon as possible to a given hostname. Not only will this resolve DNS, it will start a TCP handshake and perform TLS negotiation if the connection is SSL.
What's a URL scheme?
scheme:[//[user[:password]@]host[:port]][/path][?query][#fragment] E.g. http://memcode.com. URI schemes should be registered with the IANA, although non-registered schemes are used in practice.
What do these URL schemes do: mailto, file, data
mailto, - opens up email client, without first having to copy an addressant email and enter it. file, - typically used to retrieve files from within one's own computer. data - allows to embed small files inline in html.
What's cache busting?
Use of a unique file name to tell the browser that a new version of the file is available. Therefore the browser doesn’t retrieve the old file from cache but rather makes a request to the origin server for the new file.
What does FOUC/FOUT stand for?
Flash Of Unstyled Content/Text
What does CSRF stand for?
Cross-Site Request Forgery
Give an example of a CSRF attack.
Assume you are currently logged into your online banking at www.mybank.com You visit www.cute-cat-pictures.org, not knowing that it is a malicious site. If the owner of that site knows the form of the above request (easy!) and correctly guesses you are logged into mybank.com (requires some luck!), they could include on their page a request like http://www.mybank.com/transfer?to=123456;amount=10000. You retrieved that www.cute-cat-pictures.org page, so your browser will make that request. Your b…
What does XSS stand for?
Cross-Site Scripting
Why Same-origin policy is not enough to prevent CSRF attacks?
SOP DOES NOT prevent sending simple GET/POST requests. It does prevent a page from accessing results of cross-domain requests. Cross-origin requests come in two flavors: simple requests "not-so-simple requests" (a term I just made up) Simple requests are requests that meet the following criteria: HTTP Method matches (case-sensitive) one of: HEAD GET POST HTTP Headers matches (case-insensitive): Accept Accept-Language Content-Language Last-Event-ID Content-Type, but only if the value is one of:…
When is the request Queued?
Queueing. The browser queues requests when: There are higher priority requests. There are already six TCP connections open for this origin, which is the limit. Applies to HTTP/1.0 and HTTP/1.1 only. The browser is briefly allocating space in the disk cache Stalled. The request could be stalled for any of the reasons described in Queueing. DNS Lookup. The browser is resolving the request's IP address. Proxy negotiation. The browser is negotiating the request with a proxy server. Request sent. Th…
Describe how Gzip compression is enabled in the browser?
Browser sends request header: Accept-Encoding: gzip. Server sends response header: Content-Encoding: gzip. If browser supports Gzip, then with every request browser automatically sends the Accept-Encoding: gzip header.Server will see this header, and respond with Content-Encoding: gzip header if it supports gzipping.The browser then decompresses the content into its original uncompressed version before rendering it to the user.
What is 3D secure?
When customer is redirected to their bank’s 3D secure page on their bank's website. On their providers website, they’ll either be asked for a password (which they’ll have set up already with their bank) or will need to enter an authentication code (which will be automatically sent to their confirmed mobile phone number).After they’ve provided the correct details, the payment will be approved by the card provider and they’ll be directed back to your website. 3D secure, also referred to as 3D sec…
What does PCI (compliance) stand for?
Payment Card Industry Although the PCI DSS must be implemented by all entities that process, store or transmit cardholder data, formal validation of PCI DSS compliance is not mandatory for all entities.In the event of a security breach, any compromised entity which was not PCI DSS compliant at the time of breach will be subject to additional card scheme penalties, such as fines.All companies that process credit card information are required to maintain PCI compliance, regardless of their size o…
Why does CSRF attack work?
Because browser automatically inserts cookies of the relevant site.
How is CORS connected to CSRF?
CORS doesn't save from CSRF. However, CORS is a must, cause: CORS (Cross-Origin Resource Sharing) allows you to control which domains can make certain requests to your site. By enabling this on your api server, you will prevent attackers from making ajax calls to your endpoint that initially generates and returns the CSRF token. You’ll want this to prevent attacks where the user hasn’t visited your site yet and doesn’t already have a CSRF token. If you want to know how to set up CORS take a loo…