On Sun, Jun 7, 2009 at 4:29 PM, Adam Barth <[email protected]> wrote: > > Right, but once the attacker has XSSed site A, the attacker learns the > secret token necessary to issue the next request in the chain to site > A regardless of the method. >
Recall that this is in response to On Sun, Jun 7, 2009 at 2:53 PM, Mark S. Miller <[email protected]> wrote: > If servers at A don't freely hand out such tokens in response to guessable > GET requests, So, if servers at A don't do this, how does the attacker, having XSSes site A, learn the secret token necessary to issue the next request? -- Cheers, --MarkM
