Home/ Questions/Q 3789668
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-19T12:11:36+00:00

I am migrating from programming to ‘web programming’, so this may sound too basic

  • 0

I am migrating from programming to ‘web programming’, so this may sound too basic

My question is about a HTTP request that is responded by “victim site” with some “non-public/sensitive” information as HTML or XML or JSON.

And victim site is just relying on session cookies for authentication before responding with “non public” info for the http request.

If a the hacker’s site has a JS that makes ajax HTTP request to “victim site” and user is already logged in to “victim site” and hence has cookie for victim site in browser.

Will the ajax request be responded by “victim server” and if so can the hackers JS post this “non-public” info back to hackers site.

How would one prevent this?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    1. You cannot make a request through AJAX to other domain than the one where the JS with the AJAX is being executed.

      If the victim’s site is example.com and hacker’s site is example2.com then a JS file from example2.com can’t make an AJAX request to another site outer than example2.

    2. The cookies from the victim’s server that the client has won’t be sent to the hacker’s server in an HTTP request. The cookies can be stolen if the victim’s site has a XSS that can be exploited to send the cookies from that site to hackers.

    • 0