Re:Simple ways to improve the security of a web app
by mike-cardwell on Thursday December 08, 2011 @07:07AM
(#3328751)
On that page you'll notice it mentions "request-headers". That was in FF4 and FF5, but was removed in FF6 because of something I reported.
The headers sent in the report included "Proxy-Authorization", so it was possible to steal web proxy credentials by forcing a policy violation on your site. Chromes implementation didn't include the headers from the start. For more info:
The headers sent in the report included "Proxy-Authorization", so it was possible to steal web proxy credentials by forcing a policy violation on your site. Chromes implementation didn't include the headers from the start. For more info:
https://grepular.com/Mozilla_Security_Bug_Reveals_Web_Proxy_...
And the original report (which was recently "unclassified"):
https://bugzilla.mozilla.org/show_bug.cgi?id=664983