Re: XSS issue

Frederick Cheung
Fri, 19 Sep 2008 09:57:58 -0000

On 19 Sep 2008, at 10:46, pankaj wrote:
>
>> However, the idea of CSRF is that a user *already logged in* will be
>> tricked to post to the site from a third-party page without knowing
>> about it, thus bypassing the authentication.
> This i assume is done through some javascript..which finds it way onto
> the users "logged in" page somehow....and transfers the cookie to
the
> third party site.
>
That can''t happen: javascript can''t read cookies from domains
it
wasn''t served from.

Fred