Top 10 winner

Cross-domain leaks of site logins via Authenticated CSS

Chris Evans

Detects whether a visitor is logged in to a third-party site by loading that site's stylesheet with <link> and reading a property back with getComputedStyle. MySpace serves margin-bottom:3px to logged-in users and 0px otherwise. Argues any non-randomised CSS property value is readable cross-origin, including data: URIs in background-url.

Record

Researcher

Chris Evans

In the archive

• Ranked #7 in the 2008 Top 10 Web Hacking Techniques

Tags

• xsleak
• css
• side-channel
• info-leak
• sop-bypass
• javascript
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Chris Evans, first published at the original source. Preserved copies are kept so the citation survives its host.