News for hackers. Stuff that matters.

A comment on SSL broken. (TLS 1.0 cryptographic attack that works. Not just fake certs.). Parent comment

Re:SSL broken. (TLS 1.0 cryptographic attack that works. ... by kijin on Monday September 19, 2011 @08:45PM (#3015798)
Wouldn't that be blocked by cross-site AJAX restrictions? Or are we talking about injecting <img> and <script> tags into the document?
[ Parent | on HN ]
Re:SSL broken. (TLS 1.0 cryptographic attack that works. ... by caf on Monday September 19, 2011 @09:24PM (#3015878)
The latter, or maybe iframes.
[ Parent | on HN ]
Re:SSL broken. (TLS 1.0 cryptographic attack that works. ... by scotth on Tuesday September 20, 2011 @09:23AM (#3017411)
No, it wouldn't. With AJAX, the request always goes out, and is received and processed by the server if they choose to (most never check the request origin).

Then, the server can decide whether or not to attach cross origin resource sharing headers to the response. If those headers exist, the response is exposed to JavaScript. If not, they are swallowed by the browser.

[ Parent | on HN ]