Later archive addition

Service Workers: New APIs = New Vulns = Fun++

sirdarckcat

Shows how page JavaScript can poison service-worker caches, turning reflected XSS into persistent client-side execution. Caching redirected cross-origin responses under the original URL can also turn an open redirect into persistent XSS. Discusses response URL checks, templating, and offline CSRF handling.

Record

Researcher

sirdarckcat

In the archive

• Added to the 2015 archive after the original list was published

Related sources

• Related HackPra slides

Tags

• service-worker
• cache-poisoning
• xss
• open-redirect
• csrf
• owasp-a01-2021
• owasp-a03-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of sirdarckcat, first published at the original source. Preserved copies are kept so the citation survives its host.