Later archive addition

JavaScript Hijacking

Brian Chess

Brian Chess's 1 April 2007 Secure Coding post naming JavaScript Hijacking. Ajax frameworks returning JavaScript rather than XML can be loaded cross-origin by a script tag, so a malicious site reads confidential array or object literals. Fortify found almost every framework surveyed, including GWT and Atlas, made this easy or unavoidable.

Record

Researcher

Brian Chess

In the archive

• Added to the 2007 archive after the original list was published

Related sources

• Whitepaper

Tags

• javascript
• csrf
• info-leak
• sop-bypass
• same-origin-policy
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Brian Chess, first published at the original source. Preserved copies are kept so the citation survives its host.