Index - Web APIs
he processor. although the method is not a part of the audioworkletprocessor interface, each class that derives from it must have it implemented. 216 authenticatorassertionresponse api, authentication, authenticatorassertionresponse, interface, reference, web authentication api, webauthn the authenticatorassertionresponse interface of the web authentication api is returned by credentialscontainer.get() when a publickeycredential is passed, and provides proof to a service that it has a key pair and that the authentication request is valid and approved. 217 authenticatorassertionresponse.authenticatordata api, authenticatorassertionresponse, property, reference, web authentication api, webauthn the authenticatordata property of the authenticatorassertionrespons...
...atorassertionresponse.userhandle api, authenticatorassertionresponse, property, reference, web authentication api, webauthn the userhandle read-only property of the authenticatorassertionresponse interface is an arraybuffer object which is an opaque identifier for the given user. ...
...this response should be sent to the relying party's server to complete the creation of the credential. ...
...And 21 more matches

Cross-Origin Resource Sharing (CORS) - HTTP
request methods that can cause side-effects on server data (in particular, http methods other than get, or post with certain mime types), the specification mandates that browsers "preflight" the request, soliciting supported methods from the server with the http options request method, and then, upon "approval" from the server, sending the actual request. servers can also inform clients whether "credentials" (such as cookies and http authentication) should be sent with requests. cors failures result in errors, but for security reasons, specifics about the error are not available to javascript. all the code knows is that an error occurred. the only way to determine what specifically went wrong is to look at the browser's console for details. subsequent sections discuss scenarios, as well as provide...
...ed from response.url or xmlhttprequest.responseurl in the first step. however, if the request is one that triggers a preflight due to the presence of the authorization header in the request, you won’t be able to work around the limitation using the steps above. and you won’t be able to work around it at all unless you have control over the server the request is being made to. requests with credentials the most interesting capability exposed by both xmlhttprequest or fetch and cors is the ability to make "credentialed" requests that are aware of http cookies and http authentication information. by default, in cross-site xmlhttprequest or fetch invocations, browsers will not send credentials. a specific flag has to be set on the xmlhttprequest object or the request constructor when it is invoke...
...ent originally loaded from http://foo.example makes a simple get request to a resource on http://bar.other which sets cookies. content on foo.example might contain javascript like this: const invocation = new xmlhttprequest(); const url = 'http://bar.other/resources/credentialed-content/'; function callotherdomain() { if (invocation) { invocation.open('get', url, true); invocation.withcredentials = true; invocation.onreadystatechange = handler; invocation.send(); } } line 7 shows the flag on xmlhttprequest that has to be set in order to make the invocation with cookies, namely the withcredentials boolean value. by default, the invocation is made without cookies. since this is a simple get request, it is not preflighted, but the browser will reject any response that does not hav...
...And 8 more matches

Web Authentication API - Web APIs
omplicated passwords). many websites already have pages that allow users to register new accounts or sign in to an existing account, and the web authentication api acts as a replacement or supplement to those on those existing webpages. similar to the other forms of the credential management api, the web authentication api has two basic methods that correspond to register and login: navigator.credentials.create() - when used with the publickey option, creates new credentials, either for registering a new account or for associating a new asymmetric key pair credentials with an existing account. navigator.credentials.get() - when used with the publickey option, uses an existing set of credentials to authenticate to a service, either logging a user in or as a form of second-factor authentication. ...
...is proves to the server that a user is in possession of the private key required for authentication without revealing any secrets over the network. in order to understand how the create() and get() methods fit into the bigger picture, it is important to understand that they sit between two components that are outside the browser: server - the web authentication api is intended to register new credentials on a server (also referred to as a service or a relying party) and later use those same credentials on that same server to authenticate a user. authenticator - the credentials are created and stored in a device called an authenticator. this is a new concept in authentication: when authenticating using passwords, the password is stored in a user's brain and no other device is needed; when authent...
... can be found in the web authentication api specification. assuming the validation is successful, the server will note that the user is now authenticated. this is outside the scope of the web authentication api specification, but one option would be to drop a new cookie for the user session. interfaces credential provides information about an entity as a prerequisite to a trust decision. credentialscontainer exposes methods to request credentials and notify the user agent when events such as successful sign in or sign out happen. this interface is accessible from navigator.credentials. the web authentication specification adds a publickey member to the create() and get() methods to either create a new public key pair or get an authentication for a key pair, repsectively. publickeycredentia...
...And 7 more matches

HTTP authentication - HTTP
entication information. the challenge and response flow works like this: the server responds to a client with a 401 (unauthorized) response status and provides information on how to authorize with a www-authenticate response header containing at least one challenge. a client that wants to authenticate itself with the server can then do so by including an authorization request header with the credentials. usually a client will present a password prompt to the user and will then issue the request including the correct authorization header. in the case of a "basic" authentication like shown in the figure, the exchange must happen over an https (tls) connection to be secure. proxy authentication the same challenge and response mechanism can be used for proxy authentication. as both resource a...
...y authentication. as both resource authentication and proxy authentication can coexist, a different set of headers and status codes is needed. in the case of proxies, the challenging status code is 407 (proxy authentication required), the proxy-authenticate response header contains at least one challenge applicable to the proxy, and the proxy-authorization request header is used for providing the credentials to the proxy server. access forbidden if a (proxy) server receives valid credentials that are inadequate to access a given resource, the server should respond with the 403 forbidden status code. unlike 401 unauthorized or 407 proxy authentication required, authentication is impossible for this user. authentication of cross-origin images a potential security hole recently been fixed by browser...
...07 proxy authentication required, authentication is impossible for this user. authentication of cross-origin images a potential security hole recently been fixed by browsers is authentication of cross-site images. from firefox 59 onwards, image resources loaded from different origins to the current document are no longer able to trigger http authentication dialogs (bug 1423146), preventing user credentials being stolen if attackers were able to embed an arbitrary image into a third-party page. character encoding of http authentication browsers use utf-8 encoding for usernames and passwords. firefox once used iso-8859-1, but changed to utf-8 for parity with other browsers and to avoid potential problems as described in bug 1419658. www-authenticate and proxy-authenticate headers the www-authent...
...And 6 more matches

HTTP Index - HTTP
http, https, messages, reasons, security, console, troubleshooting cors requests may only use the https url scheme, but the url specified by the request is of a different type. this often occurs if the url specifies a local file, using a file:/// url. 30 reason: credential is not supported if the cors header ‘access-control-allow-origin’ is ‘*’ cors, corsnotsupportingcredentials, cross-origin, error, http, https, messages, reasons, security, console, troubleshooting the cors request was attempted with the credentials flag set, but the server is configured using the wildcard ("*") as the value of access-control-allow-origin, which doesn't allow the use of credentials. 31 reason: did not find method in cors header ‘access-control-allow-methods’ cor...
.... 32 reason: multiple cors header 'access-control-allow-origin' not allowed cors, corsmultiplealloworiginnotallowed, cross-origin, error, http, https, messages, reasons, security, console, troubleshooting more than one access-control-allow-origin header was sent by the server. this isn't allowed. 33 reason: expected ‘true’ in cors header ‘access-control-allow-credentials’ cors, corsmissingallowcredentials, cross-origin, error, http, https, messages, reasons, security, console, troubleshooting the cors request requires that the server permit the use of credentials, but the server's access-control-allow-credentials header's value isn't set to true to enable their use. 34 reason: invalid token ‘xyz’ in cors header ‘access-control-allow-h...
... header advertises which media-type the server is able to understand. 54 accept-ranges http, http header, range requests, reference, response header the accept-ranges response http header is a marker used by the server to advertise its support of partial requests. the value of this field indicates the unit that can be used to define a range. 55 access-control-allow-credentials access-control-allow-credentials, cors, http, reference, credentials, header the access-control-allow-credentials response header tells browsers whether to expose the response to frontend javascript code when the request's credentials mode (request.credentials) is include. 56 access-control-allow-headers cors, http, reference, response header, header the access-cont...
...And 6 more matches

Using Fetch - Web APIs
e is an http 404 or 500. instead, it will resolve normally (with ok status set to false), and it will only reject on network failure or if anything prevented the request from completing. fetch() won't can receive cross-site cookies; you can’t can establish a cross site session using fetch. set-cookie headers from other sites are silently ignored. fetch won’t send cookies, unless you set the credentials init option. (since aug 25, 2017. the spec changed the default credentials policy to same-origin. firefox changed since 61.0b13.) a basic fetch request is really simple to set up. have a look at the following code: fetch('http://example.com/movies.json') .then(response => response.json()) .then(data => console.log(data)); here we are fetching a json file across the network and printing i...
...r the full options available, and more details. // example post method implementation: async function postdata(url = '', data = {}) { // default options are marked with * const response = await fetch(url, { method: 'post', // *get, post, put, delete, etc. ...
... // the calling script...
...And 4 more matches

PublicKeyCredentialCreationOptions - Web APIs
properties publickeycredentialcreationoptions.rp an object describing the relying party which requested the credential creation. publickeycredentialcreationoptions.user an object describing the user account for which the credential is generated. publickeycredentialcreationoptions.challenge a buffersource, emitted by the relying party's server and used as a cryptographic challenge. ...
... type and the algorithm used for the cryptographic signature operations. this array is sorted by descending order of preference. publickeycredentialcreationoptions.timeout optional a numerical hint, in milliseconds, which indicates the time the caller is willing to wait for the creation operation to complete. this hint may be overridden by the browser. publickeycredentialcreationoptions.excludecredentials optional an array of descriptors for existing credentials. this is provided by the relying party to avoid creating new public key credentials for an existing user who already have some. publickeycredentialcreationoptions.authenticatorselection optional an object whose properties are criteria used to filter out the potential authenticators for the creation operation. publickeycredentialcreatio...
...enticators for the creation operation. publickeycredentialcreationoptions.attestation optional a string which indicates how the attestation (for the authenticator's origin) should be transported. publickeycredentialcreationoptions.extensions optional an object with several client extensions' inputs. those extensions are used to request additional processing (e.g. ...
...And 4 more matches

Credential Management API - Web APIs
the credential management api lets a website store and retrieve user, federated, and public key credentials. these capabilities allow users to sign in without typing passwords, see the federated account they used to sign in to a site, and resume a session without the explicit sign-in flow of an expired session. credential management concepts and usage this api lets websites interact with a user agent’s password system so that websites can deal in a uniform way with site credentials and user agents can provide better assistance with the management of their credentials. for example, user agents have a particularly hard time dealing with federated identity providers or esoteric sign-in mechanisms that use more than just a username and password. to address these problems, the credential management...
...dentials and user agents can provide better assistance with the management of their credentials. for example, user agents have a particularly hard time dealing with federated identity providers or esoteric sign-in mechanisms that use more than just a username and password. to address these problems, the credential management api provides ways for a website to store and retrieve different types of credentials. this give users capabilities such as seeing the federated account they used to sign on to a site, or resuming a session without the explicit sign-in flow of an expired session. this api is restricted to top-level contexts. calls to get() and store() within an <iframe> element will resolve without effect. ...
...ways for a website to store and retrieve different types of credentials. this give users capabilities such as seeing the federated account they used to sign on to a site, or resuming a session without the explicit sign-in flow of an expired session. this api is restricted to top-level contexts. calls to get() and store() within an <iframe> element will resolve without effect. subdomain-shared credentials later version of the spec allow credentials to be retrieved from a different subdomain. for example, a password stored in login.example.com may be used to log in to www.example.com. to take advantage of this, a password must be explicitly stored by calling credentialscontainer.store(). this is sometimes referred to as public suffix list (psl) matching; however the spec only recommends using psl ...
...And 3 more matches

PublicKeyCredential - Web APIs
redential. always set to public-key for publickeycredential instances. publickeycredential.id read only secure context inherited from credential and overridden to be the base64url encoding of publickeycredential.rawid. publickeycredential.rawid read only secure context an arraybuffer that holds the globally unique identifier for this publickeycredential. ...
...key for publickeycredential instances. publickeycredential.id read only secure context inherited from credential and overridden to be the base64url encoding of publickeycredential.rawid. publickeycredential.rawid read only secure context an arraybuffer that holds the globally unique identifier for this publickeycredential. this identifier can be used to look up credentials for future calls to credentialscontainer.get. publickeycredential.response read only secure context an instance of an authenticatorresponse object. it is either of type authenticatorattestationresponse if the publickeycredential was the results of a navigator.credentials.create() call, or of type authenticatorassertionresponse if the publickeycredential was the result of a navigator.credentials.get() call. methods publi...
...erverifyingplatformauthenticatoravailable()secure context a static method returning a promise which resolves to true if an authenticator bound to the platform is capable of verifying the user. with the current state of implementation, this method only resolves to true when windows hello is available on the system. ...
...And 3 more matches

AuthenticatorResponse - Web APIs
lenge origin and either may be returned from publickeycredential.response. interfaces based on authenticatorresponse below is a list of interfaces based on the authenticatorresponse interface. ...
...turned from publickeycredential.response. interfaces based on authenticatorresponse below is a list of interfaces based on the authenticatorresponse interface. authenticatorassertionresponse authenticatorattestationresponse properties authenticatorresponse.clientdatajson a json string in an arraybuffer, representing the client data that was passed to credentialscontainer.create() or credentialscontainer.get(). methods none. ...
...nse authenticatorattestationresponse properties authenticatorresponse.clientdatajson a json string in an arraybuffer, representing the client data that was passed to credentialscontainer.create() or credentialscontainer.get(). methods none. ...
...And 2 more matches

PublicKeyCredential.response - Web APIs
the response read-only property of the publickeycredential interface is an authenticatorresponse object which is sent from the authenticator to the user agent for the creation/fetching of credentials. the information contained in this response will be used by the relying party's server to verify the demand is legitimate. an authenticatorresponse is either: an authenticatorattestationresponse (when the publickeycredential is created via credentialscontainer.create()) an authenticatorassertionresponse (when the publickeycredential is obtained via credentialscontainer.get()). in order to validate the creation of credentials, a relying party's server needs both: this response the extensions of the client (given by publickeycredential.getclientextensionresults()) to validate the demand. n...
... note: this property may only be used in top-level contexts and will not be available in an <iframe> for example. ...
...json) and from the authenticator. ...
...And 2 more matches

PublicKeyCredentialRequestOptions - Web APIs
properties publickeycredentialrequestoptions.challenge a buffersource, emitted by the relying party's server and used as a cryptographic challenge. this value will be signed by the authenticator and the signature will be sent back as part of authenticatorassertionresponse.signature. publickeycredentialrequestoptions.timeout optional a numerical hint, in milliseconds, which indicates the time the caller is willing to wait for the retrieval operation to complete. ...
...s, which indicates the time the caller is willing to wait for the retrieval operation to complete. this hint may be overridden by the browser. publickeycredentialrequestoptions.rpid optional a usvstring which indicates the relying party's identifier (ex. "login.example.org"). if this option is not provided, the client will use the current origin's domain. publickeycredentialrequestoptions.allowcredentials optional an array of credentials descriptor which restricts the acceptable existing credentials for retrieval. publickeycredentialrequestoptions.userverification optional a string qualifying how the user verification should be part of the authentication process. publickeycredentialrequestoptions.extensions optional an object with several client extensions' inputs. those extensions are used t...
...ceptable existing credentials for retrieval. publickeycredentialrequestoptions.userverification optional a string qualifying how the user verification should be part of the authentication process. publickeycredentialrequestoptions.extensions optional an object with several client extensions' inputs. those extensions are used to request additional processing (e.g. dealing with legacy fido apis credentials, prompting a specific text on the authenticator, etc.). methods none. ...
...And 2 more matches

Request - Web APIs
request object being returned as the result of another api operation, such as a service worker fetchevent.request. constructor request() creates a new request object. properties request.cache read only contains the cache mode of the request (e.g., default, reload, no-cache). request.context read only contains the context of the request (e.g., audio, image, iframe, etc.) request.credentials read only contains the credentials of the request (e.g., omit, same-origin, include). the default is same-origin. request.destination read only returns a string from the requestdestination enum describing the request's destination. this is a string indicating the type of content being requested. request.headers read only contains the associated headers object of the request. request.inte...
...nce; subsequent calls will resolve with empty strings/arraybuffers. ...
...will resolve with empty strings/arraybuffers. ...
...And 2 more matches

Website security - Learn web development
able users; select * from userinfo where \'t\' = \'t'; web frameworks will often take care of the character escaping for you. django, for example, ensures that any user-data passed to querysets (model queries) is escaped. note: this section draws heavily on the information in wikipedia here. cross-site request forgery (csrf) csrf attacks allow a malicious user to execute actions using the credentials of another user without that user’s knowledge or consent. this type of attack is best explained by example. john is a malicious user who knows that a particular site allows logged-in users to send money to a specified account using an http post request that includes the account name and an amount of money. john constructs a form that includes his bank details and an amount of money as hidden f...
...ser behavior). the server will check the cookies, and use them to determine whether or not the user is logged in and has permission to make the transaction. the result is that any user who clicks the submit button while they are logged in to the trading site will make the transaction. john gets rich. note: the trick here is that john doesn't need to have access to the user's cookies (or access credentials). the browser of the user stores this information and automatically includes it in all requests to the associated server. one way to prevent this type of attack is for the server to require that post requests include a user-specific site-generated secret. the secret would be supplied by the server when sending the web form used to make transfers. this approach prevents john from creating his ow...
...t same form to attack every user. web frameworks often include such csrf prevention mechanisms. other threats other common attacks/vulnerabilities include: clickjacking. in this attack, a malicious user hijacks clicks meant for a visible top-level site and routes them to a hidden page beneath. this technique might be used, for example, to display a legitimate bank site but capture the login credentials into an invisible <iframe> controlled by the attacker. clickjacking could also be used to get the user to click a button on a visible site, but in doing so actually unwittingly click a completely different button. as a defense, your site can prevent itself from being embedded in an iframe in another site by setting the appropriate http headers. denial of service (dos). dos is usually achieved by...
...ion for your site, so that in addition to a password the user must enter another authentication code (usually one that is delivered via some physical hardware that only the user will have, such as a code in an sms sent to their phone). configure your web server to use https and http strict transport security (hsts). https encrypts data sent between your client and server. this ensures that login credentials, cookies, post requests data and header information are not easily available to attackers. keep track of the most popular threats (the current owasp list is here) and address the most common vulnerabilities first. use vulnerability scanning tools to perform automated security testing on your site. later on, your very successful website may also find bugs by offering a bug bounty like mozilla do...

AuthenticatorAssertionResponse - Web APIs
this interface inherites from authenticatorresponse. note: this interface is restricted to top-level contexts. use from within an <iframe> element will not have any effect. properties authenticatorassertionresponse.clientdatajson secure contextread only the client data for the authentication, such as origin and challenge. the clientdatajson property is inherited from the authenticatorresponse. ...
...nter, test of user presence and user verification flags, and any extensions processed by the authenticator. authenticatorassertionresponse.signature secure contextread only an assertion signature over authenticatorassertionresponse.authenticatordata and authenticatorresponse.clientdatajson. ...
...ted with the private key of keypair that was created during the navigator.credentials.create() call and verified using the public key of that same keypair. authenticatorassertionresponse.userhandle secure contextread only an arraybuffer containing an opaque user identifier. methods none. ...
... recommendation initial definition. ...

HTML attribute: crossorigin - HTML: Hypertext Markup Language
e configuration of the cors requests for the element's fetched data. depending on the element, the attribute can be a cors settings attribute. the crossorigin content attribute on media elements is a cors settings attribute. these attributes are enumerated, and have the following possible values: keyword description anonymous cors requests for this element will have the credentials flag set to 'same-origin'. use-credentials cors requests for this element will have the credentials flag set to 'include'. "" setting the attribute name to an empty value, like crossorigin or crossorigin="", is the same as anonymous. by default (that is, when the attribute is not specified), cors is not used at all. the "anonymous" keyword means that there will be n...
... an invalid keyword and an empty string will be handled as the anonymous keyword. ...
...es or http authentication as described in the terminology section of the cors specification, unless it is in the same origin. an invalid keyword and an empty string will be handled as the anonymous keyword. example: crossorigin with the script element you can use the following <script> element to tell a browser to execute the https://example.com/example-framework.js script without sending user-credentials. ...
...invalid keyword and an empty string will be handled as the anonymous keyword. example: crossorigin with the script element you can use the following <script> element to tell a browser to execute the https://example.com/example-framework.js script without sending user-credentials. <script src="https://example.com/example-framework.js" crossorigin="anonymous"></script> example: webmanifest with credentials the use-credentials value must be used when fetching a manifest that requires credentials, even if the file is from the same origin. <link rel="manifest" href="/app.webmanifest" crossorigin="use-credentials"> specifications specification status comment html living standardthe definition of 'cors settings attributes' in that specification. living standard ...

Downloading Files - Archive of obsolete content
if you want to open a login prompt, you ...
...if you want to open a login prompt, you can use the default prompt by calling the window watcher's getnewauthprompter() method. ...
...if you want to open a login prompt, you can use the default prompt by calling the window watcher's getnewauthprompter() method. ...

How do you upload your files to a web server? - Learn web development
osting provider" whose urls look like this: mypersonalwebsite.examplehostingprovider.net. we have just opened an account and received this info from them: congratulations for opening an account at example hosting provider. your account is: demozilla your website will be visible at demozilla.examplehostingprovider.net to publish to this account, please connect through sftp with the following credentials: sftp server: sftp://demozilla.examplehostingprovider.net username: demozilla password: quickbrownfox port: 5548 to publish on the web, put your files into the public/htdocs directory. let's first look at http://demozilla.examplehostingprovider.net/ — as you can see, so far there is nothing there: note: depending on your hosting provider, most of the time you'll see a page saying ...
...mand line. a basic command looks like so: rsync [-options] source user@x.x.x.x:destination -options is a dash followed by a one or more letters, for example -v for verbose error messages, and -b to make backups. you can see the full list at the rsync man page (search for "options summary"). source is the path to the local file or directory that you want to copy files over from. user@ is the credentials of the user on the remote server you want to copy files over to. x.x.x.x is the ip address of the remote server. destination is the path to the location you want to copy your directory or files to on the remote server. you'd need to get such details from your hosting provider. for more information and further examples, see how to use rsync to copy/sync files between servers. of course, it i...
...tails go here]" source user@x.x.x.x:destination you can find more details of what is needed at how to copy files with rsync over ssh. rsync gui tools as with other command line tools, gui tools also exist for rsync, for those who are not as comfortable with using the command line. acrosync is one such tool, and it is available for windows and macos. again, you would have to get the connection credentials from your hosting provider, but this way you'd have a gui to enter them in. github github allows you to publish websites via github pages (gh-pages). we've covered the basics of using this in the publishing your website article from our getting started with the web guide, so we aren't going to repeat it all here. however, it is worth knowing that you can also host a website on github, but use...

AuthenticatorAssertionResponse.authenticatorData - Web APIs
dcredentialdata if it is present, or will immediatelly follow the first 37 bytes of the authenticatordata if no attestedcredentialdata is present. signcount (4 bytes) - a signature count from the authenticator. the server will use this counter to detect authenticator cloning. attestedcredentialdata (variable length) - the credential that was created. this is only present during a navigator.credentials.create() call. this is a sequence of bytes with the following format: aaguid (16 bytes) - authenticator attestation globally unique identifier, a unique number that identifies the model of the authenticator (not the specific instance of the authenticator) so that a relying party can understand the characteristics of the authenticator by looking up its metadata statement. credentialidleng...
...lickey (variable length) - a cose encoded public key. this public key will be stored on the server associated with a user's account and be used for future authentications. extensions (variable length) - an optional cbor map of extensions. ...
... recommendation initial definition. ...

AuthenticatorAssertionResponse.signature - Web APIs
-256 hash of the client data (authenticatorassertionresponse.clientdatajson). this signature will be sent to the server for control, as part of the response. it provides the proof that an authenticator does possess the private key which was used for the credential's generation. note: an authenticatorassertionresponse instance is available on publickeycredential.response after calling navigator.credentials.get(). note: this property may only be used in top-level contexts and will not be available in an <iframe> for example. syntax signature = authenticatorassertionresponse.signature value an arraybuffer object which the signature of the authenticator (using its private key) for both authenticatorassertionresponse.authenticatordata and a sha-256 hash given by the client for its data (the cha...
...thenticator (using its private key) for both authenticatorassertionresponse.authenticatordata and a sha-256 hash given by the client for its data (the challenge, the origin, etc. and available from authenticatorassertionresponse.clientdatajson). ...
... recommendation initial definition. ...

AuthenticatorAssertionResponse.userHandle - Web APIs
the userhandle read-only property of the authenticatorassertionresponse interface is an arraybuffer object which is an opaque identifier for the given user. such an identifier can be used by the relying party's server to link the user account with its corresponding credentials and other data. the same value may be found on the id property of the options.user object (used for the creation of the publickeycredential instance). note: an authenticatorassertionresponse instance is available on publickeycredential.response after calling navigator.credentials.get(). note: this property may only be used in top-level contexts and will not be available in an <iframe> for example. syntax userhandle = authenticatorassertionresponse.userhandle value an arraybuffer object which is an opaque identifie...
...atorassertionresponse.userhandle value an arraybuffer object which is an opaque identifier for the current user. this is not human-readable and does not contain any personally identifying information (e.g. ...
... recommendation initial definition. ...

AuthenticatorAttestationResponse.attestationObject - Web APIs
the attestationobject property of the authenticatorattestationresponse interface returns an arraybuffer containing the new public key, as well as signature over the entire attestationobject with a private key that is stored in the authenticator when it is manufactured. as part of the credentialscontainer.create() call, an authenticator will create a new keypair as well as an attestationobject for that keypair. the public key that corresponds to the private key that has created the attestation signature is well known; however, there are various well known attestation public key chains for different ecosystems (for example, android or tpm attestations). syntax attestobj = authenticatorattestationresponse.attestationobject properties after decoding the cbor encoded arraybuffer, the resulting jav...
...t". for now, see the webauthn specification for details on each format. ...
... recommendation initial definition. ...

AuthenticatorAttestationResponse.getTransports() - Web APIs
thenticatorattestationresponse interface that returns an array containing strings describing the different transports which may be used by the authenticator. such transports may be usb, nfc, ble or internal (applicable when the authenticator is not removable from the device). note: an authenticatorattestationresponse instance is available on publickeycredential.response after calling navigator.credentials.create(). note: this method may only be used in top-level contexts and will not be available in an <iframe> for example. syntaxe arrtransports = authenticatorattestationresponse.gettransports() parameters none. return value an array containing the different transports supported by the authenticator or nothing if this information is not available.of the processing of the different extens...
...ticator is specifically bound to the client device (cannot be removed). ...
... recommendation initial definition. ...

AuthenticatorAttestationResponse - Web APIs
this response should be sent to the relying party's server to complete the creation of the credential. this interface inherites from authenticatorresponse. note: this interface is restricted to top-level contexts. use from within an <iframe> element will not have any effect. properties authenticatorattestationresponse.clientdatajson secure contextread only client data for the authentication, such as origin and challenge. ...
...henticator. the array may be empty if the information is not available. ...
... recommendation initial definition. ...

EventSource - Web APIs
sse connections across all of the tabs to www.example1.com and another 6 sse connections to www.example2.com. (from stackoverflow). when using http/2, the maximum number of simultaneous http streams is negotiated between the server and the client (defaults to 100). ...
... event handlers eventsource.onerror is an eventhandler called when an error occurs and the error event is dispatched on an eventsource object. ...
...perties from its parent, eventtarget. eventsource.readystate read only a number representing the state of the connection. possible values are connecting (0), open (1), or closed (2). eventsource.url read only a domstring representing the url of the source. eventsource.withcredentials read only a boolean indicating whether the eventsource object was instantiated with cross-origin (cors) credentials set (true), or not (false, the default). event handlers eventsource.onerror is an eventhandler called when an error occurs and the error event is dispatched on an eventsource object. eventsource.onmessage is an eventhandler called when a message event is received, that is when a message is coming from the source. eventsource.onopen is an eventhandler called when an open event is receive...

PasswordCredential.additionalData - Web APIs
the additionaldata property of the passwordcredential interface takes one of a formdata instance, a urlsearchparams instance, or null. the data in the objects will be added to the request body and sent to the remote endpoint with the credentials. syntax passwordcredential.additionaldata = formdata formdata = passwordcredential.additionaldata passwordcredential.additionaldata = urlsearchparams ulrsearchparams = passwordcredential.additionaldata value one of a formdata instance, a urlsearchparams instance, or null. ...
... = urlsearchparams ulrsearchparams = passwordcredential.additionaldata value one of a formdata instance, a urlsearchparams instance, or null. example the following example creates a formdata object with an appended csrf token. it then stores the form object in the additionaldata parameter, before sending it to server in a call to fetch. //the options object was previously created. ...
... in a call to fetch. //the options object was previously created. navigator.credentials.get(options).then(function(creds) { if (creds.type == 'password') { var form = new formdata(); var csrf_token = document.queryselector('csrf_token').value; form.append('csrf_token', csrf_token); creds.additionaldata = form; fetch('https://www.example.com', { method: 'post', credentials: creds }); }; }); specifications specification status comment credential management level 1 working draft initial definition. ...

PublicKeyCredential.getClientExtensionResults() - Web APIs
getclientextensionresults() is a method of the publickeycredential interface that returns an arraybuffer which contains a map between the extensions identifiers and their results after having being processed by the client. during the creation or fetching of a publickeycredential (respectively via navigator.credentials.create() and navigator.credentials.get()), it is possible to have "custom" processing by the client for different extensions which are respectively given by publickeycredentialcreationoptions.extensions and publickeycredentialrequestoptions.extensions. note: extensions are optional and different browsers may recognize different extensions. all extensions are optional for the client to process them: if a browser does not know of a given extension, that will not cause any fa...
... // user verification index: how the user was verified }, challenge: new uint8array(16) /* from the server */, rp: { name: "example corp", id : "login.example.com" }, user: { id: new uint8array(16) /* from the server */, name: "jdoe@example.com", displayname: "john doe" }, pubkeycredparams: [ { type: "public-key", alg: -7 } ] }; navigator.credentials.create({ publickey }) .then(function (newcredentialinfo) { var mybuffer = newcredentialinfo.getclientextensionresults(); // mybuffer will contain the result of any of the processing of the "loc" and "uvi" extensions }).catch(function (err) { console.error(err); }); specifications specification status comment web authentication: an api for accessing...
... recommendation initial definition. ...

PublicKeyCredential.rawId - Web APIs
this identifier is expected to be globally unique and is appointed for the current publickeycredential and its associated authenticatorassertionresponse. ...
...this identifier is expected to be globally unique and is appointed for the current publickeycredential and its associated authenticatorassertionresponse. ...
...orassertionresponse. examples var options = { challenge: new uint8array(26) /* from the server */, rp: { name: "example corp", id : "login.example.com" }, user: { id: new uint8array(26), /* to be changed for each user */ name: "jdoe@example.com", displayname: "john doe", }, pubkeycredparams: [ { type: "public-key", alg: -7 } ] }; navigator.credentials.create({ publickey: options }) .then(function (pubkeycredential) { var rawid = pubkeycredential.rawid; // do something with rawid }).catch(function (err) { // deal with any error }); specifications specification status comment web authentication: an api for accessing public key credentials level 1the definition of 'rawid' in that specification. recom...

PublicKeyCredentialCreationOptions.extensions - Web APIs
ions dictionary, is an object providing the client extensions and their input values. extensions are values requesting additional processing by the client and by the authenticator. for instance, extensions may be used for: backward compatibility with the legacy fido js api, knowing the user verification process, etc. note: an analogous option exists for the fetching operation (navigators.credentials.get()), see publickeycredentialrequestoptions.extensions. syntax extensions = publickeycredentialcreationoptions.extensions value an object with various keys and values. here is the current (as of march 2019) list of potential extensions which may be used during the registration operation. warning! as of june 2020, only appid (used during creation with publickeycredentialrequestoptions.ex...
...e, uvm: false, exts: true }, challenge: new uint8array(26) /* this actually is given from the server */, rp: { name: "example corp", id : "login.example.com" }, user: { id: new uint8array(26), /* to be changed for each user */ name: "jdoe@example.com", displayname: "john doe", }, pubkeycredparams: [ { type: "public-key", alg: -7 } ] }; navigator.credentials.create({ publickey }) .then(function (newcredentialinfo) { // mybuffer will contain the result of any of the processing of the extensions var mybuffer = newcredentialinfo.getclientextensionresults(); // send attestation response and client extensions // to the server to proceed with the registration // of the credential }).catch(function (err) { console.error(err); ...
... recommendation initial definition. ...

PublicKeyCredentialCreationOptions.rp - Web APIs
syntax relyingpartyobj = publickeycredentialcreationoptions.rp properties icon optional an url as a usvstring value which points to an image resource which can be the logo/icon of the relying party. id a domstring uniquely identifying a relying party. the default value of this property is the domain of the current document (e.g. "login.example.com"). it may be overridden with a suffix of the current domain (e.g. "example.com"). ...
...(e.g. "example corp"). ...
... recommendation initial definition. ...

PublicKeyCredentialCreationOptions.timeout - Web APIs
the timeout property, of the publickeycredentialcreationoptions dictionary, represents an hint, given in milliseconds, for the time the script is willing to wait for the completion of the creation operation. this property is optional and merely is a hint which may be overridden by the browser. note: an analogous option exists for the fetching operation (navigators.credentials.get()), see publickeycredentialrequestoptions.timeout. syntax timeout = publickeycredentialcreationoptions.timeout value a numerical hint, expressed in milliseconds, giving the time to wait for the creation operation to complete. examples var publickey = { timeout: 6000, // accepting to wait for a minute before giving up. challenge: new uint8array(26) /* this actually is given from the server */, rp: { nam...
...minute before giving up. ...
... recommendation initial definition. ...

PublicKeyCredentialCreationOptions.user - Web APIs
the user property of the publickeycredentialcreationoptions dictionary is an object describing the user account for which the credentials are generated (via navigator.credentials.create()). syntax useraccount = publickeycredentialcreationoptions.user properties displayname a domstring which is human readable and intended for display. it may be the full name of the user (e.g. "john doe"). this is not intended to store the login of the user (see name below). icon optional an url as a usvstring value which points to an image resource which can be the avatar image for the user. id a buffersource uniquely identifying a given user. this an opaque identifier which can be used by the authenticator to link the user account with its corresponding credentials. this value will later be used when fe...
...to store the login of the user (see name below). icon optional an url as a usvstring value which points to an image resource which can be the avatar image for the user. id a buffersource uniquely identifying a given user. this an opaque identifier which can be used by the authenticator to link the user account with its corresponding credentials. this value will later be used when fetching the credentials in authenticatorassertionresponse.userhandle. name a domstring giving a human-readable name for the user's identifier (e.g. "jdoe@example.com").this property is intended for display and may be use to distinguish different account with the same displayname. examples var publickey = { challenge: new uint8array(26) /* this actually is given from the server */, rp: { name: "example corp"...
... name: "example corp", id : "login.example.com" }, user: { // to be changed for each user id: new uint8array.from(window.atob("laegmlkjnrlkgnamlafalfka="), c=>c.charcodeat(0)); name: "jdoe@example.com", displayname: "john doe", icon: "https://gravatar.com/avatar/jdoe.png" }, pubkeycredparams: [ { type: "public-key", alg: -7 } ] }; navigator.credentials.create({ publickey }) .then(function (newcredentialinfo) { // send attestation response and client extensions // to the server to proceed with the registration // of the credential }).catch(function (err) { console.error(err); }); specifications specification status comment web authentication: an api for accessing public key credentials level 1...

PublicKeyCredentialRequestOptions.challenge - Web APIs
ions dictionary is a buffersource used as a cryptographic challenge. this is randomly generated then sent from the relying party's server. this value (among other client data) will be signed by the authenticator's private key and produce authenticatorassertionresponse.signature which should be sent back to the server as part of the response. note: when the credential is created with a navigator.credentials.create() call, the signature of the challenge is contained within authenticatorattestationresponse.attestationobject. note: a challenge will be at least 16 bytes long. syntax challenge = publickeycredentialrequestoptions.challenge value a buffersource which is at least 16 bytes long. contains a cryptographic challenge emitted from the relying party's server which must be signed by the aut...
...equestoptions.challenge value a buffersource which is at least 16 bytes long. contains a cryptographic challenge emitted from the relying party's server which must be signed by the authenticator's private key and sent back (within the response) to the relying party's server for verification. ...
...erver */]) }; navigator.credentials.get({ "publickey": options }) .then(function (credentialinfoassertion) { // send assertion response back to the server // to proceed with the control of the credential }).catch(function (err) { console.error(err); }); specifications specification status comment web authentication: an api for accessing public key credentials level 1the definition of 'challenge' in that specification. recommendation initial definition. ...

PublicKeyCredentialRequestOptions.extensions - Web APIs
ions dictionary, is an object providing the client extensions and their input values. extensions are values requesting additional processing by the client and by the authenticator. for instance, extensions may be used for: backward compatibility with the legacy fido js api, knowing the user verification process, etc. note: an analogous option exists for the creation operation (navigators.credentials.create()), see publickeycredentialcreationoptions.extensions. syntax extensions = publickeycredentialrequestoptions.extensions value an object with various keys and values. here is the current (as of march 2019) list of potential extensions which may be used during the registration operation. warning! as of june 2020, only appid is supported by chrome and edge. firefox does not seem to su...
...ons. all extensions are optional for the client to process them: if a browser does not know a given extension, that will not cause any failure, the extension simply will not be processed. ...
...erver */]) }; navigator.credentials.get({ "publickey": options }) .then(function (credentialinfoassertion) { // send assertion response back to the server // to proceed with the control of the credential }).catch(function (err) { console.error(err); }); specifications specification status comment web authentication: an api for accessing public key credentials level 1the definition of 'extensions' in that specification. recommendation initial definition. ...

PublicKeyCredentialRequestOptions.rpId - Web APIs
ing. its value can only be a suffix of the current origin's domain. for example, if you are browsing on foo.example.com, the rpid value may be "example.com" but not "bar.org" or "baz.example.com". this property is optional. if it is not explicitely provided, the user agent will use the value of the current origin's domain. note: an analogous option exists for the creation operation (navigators.credentials.create()), see the id property of publickeycredentialcreationoptions.rp. syntax rpid = publickeycredentialrequestoptions.rpid value a usvstring for the identifier of the relying party. its value can only be a suffix of the current origin's domain. examples var options = { challenge: new uint8array([/* bytes sent from the server */]), rpid: "example.com" // will only work if the current...
...x rpid = publickeycredentialrequestoptions.rpid value a usvstring for the identifier of the relying party. its value can only be a suffix of the current origin's domain. ...
...example.com }; navigator.credentials.get({ "publickey": options }) .then(function (credentialinfoassertion) { // send assertion response back to the server // to proceed with the control of the credential }).catch(function (err) { console.error(err); }); specifications specification status comment web authentication: an api for accessing public key credentials level 1the definition of 'rpid' in that specification. recommendation initial definition. ...

PublicKeyCredentialRequestOptions.timeout - Web APIs
the timeout property, of the publickeycredentialrequestoptions dictionary, represents an hint, given in milliseconds, for the time the script is willing to wait for the completion of the retrieval operation. this property is optional and merely is a hint which may be overridden by the browser. note: an analogous option exists for the creation operation (navigators.credentials.create()), see publickeycredentialcreationoptions.timeout. syntax timeout = publickeycredentialrequestoptions.timeout value a numerical hint, expressed in milliseconds, giving the time to wait for the creation operation to complete. examples var options = { challenge: new uint8array([/* bytes sent from the server */]), timeout: 6000 // wait a minute for the fetching operation // and maybe fail ...
... syntax timeout = publickeycredentialrequestoptions.timeout value a numerical hint, expressed in milliseconds, giving the time to wait for the creation operation to complete. ...
...akes longer }; navigator.credentials.get({ "publickey": options }) .then(function (credentialinfoassertion) { // send assertion response back to the server // to proceed with the control of the credential }).catch(function (err) { console.error(err); }); specifications specification status comment web authentication: an api for accessing public key credentials level 1the definition of 'timeout' in that specification. recommendation initial definition. ...

PublicKeyCredentialRequestOptions.userVerification - Web APIs
userverification is an optional property of the publickeycredentialrequestoptions. this is a string which indicates how the user verification should be part of the authentication process. note: an analogous option exists for the creation operation (navigators.credentials.create()), see the userverification property of publickeycredentialcreationoptions.authenticatorselection. syntax userverification = publickeycredentialrequestoptions.userverification value a string qualifying how the user verification should be part of the authentication process. the values may be: "required": user verification is required, the operation will fail if the response does not have the uv flag (as part of authenticatorassertionresponse.authenticatordata) "preferred": user verification is prefered, the opera...
...ot fail if the response does not have the uv flag (as part of authenticatorassertionresponse.authenticatordata) "discouraged": user verification should not be employed as to minimize the user interaction during the process. the default value is "preferred". ...
...erver */]), }; navigator.credentials.get({ "publickey": options }) .then(function (credentialinfoassertion) { // send assertion response back to the server // to proceed with the control of the credential }).catch(function (err) { console.error(err); }); specifications specification status comment web authentication: an api for accessing public key credentials level 1the definition of 'userverification' in that specification. recommendation initial definition. ...

WindowOrWorkerGlobalScope.fetch() - Web APIs
bject or an object literal with bytestring values. note that some names are forbidden. body any body that you want to add to your request: this can be a blob, buffersource, formdata, urlsearchparams, usvstring, or readablestream object. note that a request using the get or head method cannot have a body. mode the mode you want to use for the request, e.g., cors, no-cors, or same-origin. credentials the request credentials you want to use for the request: omit, same-origin, or include. to automatically send cookies for the current domain, this option must be provided. starting with chrome 50, this property also takes a federatedcredential instance or a passwordcredential instance. cache the cache mode you want to use for the request. redirect the redirect mode to use: follow (autom...
...r the navigator.sendbeacon() api. signal an abortsignal object instance; allows you to communicate with a fetch request and abort it if desired via an abortcontroller. return value a promise that resolves to a response object. exceptions aborterror the request was aborted due to a call to the abortcontroller method abort() method. typeerror the specified url string includes user credentials. this information should instead be provided using an authorization header. examples in our fetch request example (see fetch request live) we create a new request object using the relevant constructor, then fetch it using a fetch() call. since we are fetching an image, we run body.blob() on the response to give it the proper mime type so it will be handled properly, then create an object url o...
... ...

Index - HTTP
his happens rarely (and is frowned upon as it leads to fingerprinting). 6 accept-ranges http, http header, range requests, reference, response header the accept-ranges response http header is a marker used by the server to advertise its support of partial requests. the value of this field indicates the unit that can be used to define a range. 7 access-control-allow-credentials cors, http, reference, header the access-control-allow-credentials response header tells browsers whether to expose the response to frontend javascript code when the request's credentials mode (request.credentials) is "include". 8 access-control-allow-headers cors, http, reference, header the access-control-allow-headers response header is used in response to a pref...
... the allow header lists the set of methods support by a resource. 17 alt-svc draft, http, http header, needscompattable, needscontent, needsexample, reference the alt-svc header is used to list alternate ways to reach this website. 18 authorization http, http header, reference, request header, header the http authorization request header contains the credentials to authenticate a user agent with a server, usually after the server has responded with a 401 unauthorized status and the www-authenticate header. 19 cache-control general header, http, http header, reference the cache-control general-header field is used to specify directives for caching mechanisms in both requests and responses. caching directives are unidirectional, meanin...
... the http proxy-authenticate response header defines the authentication method that should be used to gain access to a resource behind a proxy server. it authenticates the request to the proxy server, allowing it to transmit the request further. 90 proxy-authorization http, http header, reference, request header, header the http proxy-authorization request header contains the credentials to authenticate a user agent to a proxy server, usually after the server has responded with a 407 proxy authentication required status and the proxy-authenticate header. 91 public-key-pins hpkp, http, reference, security, header the http public-key-pins response header associates a specific cryptographic public key with a certain web server to decrease the risk of mitm attack...

Proxy-Authorization - HTTP
the resulting string is base64 encoded (ywxhzgrpbjpvcgvuc2vzyw1l). ...
... the resulting string is base64 encoded (ywxhzgrpbjpvcgvuc2vzyw1l). ...
...o a proxy server, usually after the server has responded with a 407 proxy authentication required status and the proxy-authenticate header. header type request header forbidden header name no syntax proxy-authorization: <type> <credentials> directives <type> authentication type. a common type is "basic". see also the iana registry of authentication schemes. <credentials> the credentials are constructed like this: the username and the password are combined with a colon (aladdin:opensesame). the resulting string is base64 encoded (ywxhzgrpbjpvcgvuc2vzyw1l). note: base64 encoding does not mean encryption or hashing! this method is equally secure as sending the credentials in clear text (base64 is a reversible encoding). prefer to use https in conjuncti...

jpm - Archive of obsolete content
you can omit the --xpi argument, in which case jpm sign will generate an xpi from the current directory (or --addon-dir). jpm sign --api-key ${jwt_issuer} --api-secret ${jwt_secret} this submits an xpi it to the addons.mozilla.org signing api, then downloads a signed xpi to the working directory if it passes validation. to get values for --api-key and --api-secret, you will need to create api credentials on addons.mozilla.org. on the amo key management page, these values are labeled "jwt_issuer" and "jwt_secret". here are some possible outcomes of running the sign command: your add-on passed validation, was signed by mozilla, and a new signed xpi was downloaded to your working directory. your add-on failed validation, was not signed, and you got a link to a detailed report. after fixing the ...
...ey management page, this value is labeled "jwt issuer". --api-secret=jwt_secret api access secret (string) generated on the addons.mozilla.org key management page. this value should be guarded with care and never checked into version control. if your secret is compromised, another developer could upload add-ons to your account. you should revoke and regenerate compromised api credentials immediately. on the amo key management page, this value is labeled "jwt secret". --api-url-prefix=http://.../api an optional api url prefix in case you'd like to use a pre-production signing api. for example, you could pass https://addons-dev.allizom.org/api/v3 to use the dev instance of addons.mozilla.org. --xpi=/path/to/file.xpi an xpi file to...

Index - Archive of obsolete content
ages whose url matches a given pattern. 50 page-worker add-on sdk create a permanent, invisible page and access its dom. 51 panel add-on sdk, add-ons, extensions creates transient dialogs to implement part of an add-on's user interface. 52 passwords add-on sdk interact with firefox's password manager to add, retrieve and remove stored credentials. 53 private-browsing add-on sdk check whether a given object is private, so an add-on can respect private browsing 54 querystring add-on sdk utility functions for working with query strings. 55 request needsupdate, sdk, add-on make simple network requests. 56 selection add-on sdk get and set text and html selectio...
...key from user's password. keep in mind that firefox accounts does not provide a storage solution, it is up to you to use the generated key and encrypt the data with that key. 450 firefox accounts oauth dashboard authentication, firefox accounts, identity, mozilla, fxa fxa oauth credential management dashboard is a web application that lets you provision firefox accounts oauth credentials. 452 introduction to firefox accounts fxa firefox accounts (fxa) is an identity provider that provides authentication and user profile data for mozilla cloud services. we are also exploring the possibility of allowing non-mozilla services to delegate authentication to firefox accounts. 454 jss build instructions for osx 10.6 jss the following build inst...

SQL Injection - MDN Web Docs Glossary: Definitions of Web-related terms
hackers use this insecurity to gain unauthorized access. hackers use a simple string called a magical string, for example: username: admin password: anything 'or'1'='1 after clicking on the login button, the sql query will work as follows: "select count(*) from users where username=' ad...
...='1 ' the password is not 'anything', hence password=anything results in false, but '1'='1' is a true statement and hence returns a true value. finally, due to the or operator, the value ( false or true ) is true, so authentication bypasses successfully. just due to a simple string (magical string) the entire database is compromised. how to prevent before executing the queries for the user credentials, make some changes like the following: $id = $_get['id'] (1) $id = stripslashes($id) (2) $id = mysql_real_escape_string($id) so due to (1) each single quote (') in the input string is replaced with double quotes ("), and due to (2) before every (') it adds (/). the revised magical string fails to bypass the authentication, and your database stays secure. learn more general knowledge sql...

Phishing: a short definition
. a relatively simple, yet effective, phishing scheme is sending an email with a fake invoice of a person’s favorite shopping site. this email will usually contain a link pretending to lead to the original service, but in reality, taking the victim to an attacker-controlled website. the login portal might resemble the trusted website's login page very closely, and convince users to enter their credentials, letting others hijack their account. past and current countermeasures various technical, and social approaches, exist to combat phishing attacks. none of these are sufficient by themselves, so we see a mix of these deployed by various services. the following is a non-exhaustive list of the most common approaches. shifting blame to users some quick-to-implement, and cost-effective solutions, ...
...earlier responses by affected banks, and payment providers, was to attempt educating users to not click links in emails, along with requesting to verify email legitimacy through checking for relevant personal information. another solution is to strengthen logins with pictures, or colored words, often chosen when signing up for a service. users look for these when logging in, and only enter their credentials when they recognize the user defined pictures or words. a study on the efficacy of security indicators, presented at the 2007 ieee symposium on security and privacy, suggests that the above countermeasures fail to protect the majority of users. this too, includes missing https or ev certificate indicators in a browser’s navigation bar. services assuming responsibility technical solutions can...

NSS 3.51.1 release notes
bution information the hg tag is nss_3_51_1_rtm. nss 3.51.1 requires nspr 4.25 or newer. nss 3.51.1 source distributions are available on ftp.mozilla.org for secure https download: source tarballs: https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/nss_3_51_1_rtm/src/ other releases are available in nss releases. notable changes in nss 3.51.1 bug 1617968 - update delegated credentials implementation to draft-07. bugs fixed in nss 3.51.1 bug 1619102 - add workaround option to include both dtls and tls versions in dtls supported_versions. bug 1619056 - update readme: tls 1.3 is not experimental anymore. bug 1618739 - don't assert fuzzer behavior in ssl_parsesessionticket. bug 1618915 - fix ubsan issue in ssl_parsesessionticket. bug 1608245 - consistently handle null slo...
... to include both dtls and tls versions in dtls supported_versions. bug 1619056 - update readme: tls 1.3 is not experimental anymore. bug 1618739 - don't assert fuzzer behavior in ssl_parsesessionticket. bug 1618915 - fix ubsan issue in ssl_parsesessionticket. bug 1608245 - consistently handle null slot/session. bug 1608250 - broken fipstest handling of ki_len. bug 1617968 - update delegated credentials implementation to draft-07. compatibility nss 3.51.1 shared libraries are backward compatible with all older nss 3.x shared libraries. a program linked with older nss 3.x shared libraries will work with nss 3.51.1 shared libraries without recompiling or relinking. furthermore, applications that restrict their use of nss apis to the functions listed in nss public functions will remain compatibl...

XPCOM Interface Reference by grouping
sagemanager nsiscriptableio nsixpcscriptable future nsixmlhttprequestupload obsolete nsixmlrpcclient nsixmlrpcfault security auth nsiauthmodule nsiauthprompt nsiauthpromptprovider nsiauthpromptwrapper nsiasyncverifyredirectcallback content nsicontentpolicy credentials nsilogininfo nsiloginmanager using nsiloginmanager nsiloginmanagerstorage nsiloginmetainfo history nsiglobalhistory nsiglobalhistory2 nsiglobalhistory3 ssl nsibadcertlistener2 system action nsicancelable application ...
... nsialertsservice nsiwebprogress nsiwebprogresslistener nsiwebprogresslistener2 update nsiupdate nsiupdatechecker nsiupdatechecklistener nsiupdateitem nsiupdatemanager nsiupdatepatch nsiupdateprompt nsiupdatetimermanager nsiprogramminglanguage thunderbird credentials nsimsgaccountmanagerextension element nsieditormailsupport message nsidbchangeannouncer nsidbchangelistener nsimessenger nsimsgcompfields nsimsgcustomcolumnhandler nsimsgdatabase nsimsgdbhdr nsimsgdbview nsimsgdbviewcommandupdater nsimsgfolder nsimsgidentity nsims...

nsIMsgCloudFileProvider
file that is currently being uploaded to cancel. refreshuserinfo() refreshes the data for this user account - for example, the storage quota, or the amount of storage being used. void refreshuserinfo(in boolean awithui, in nsirequestobserver acallback); parameters awithui whether or not the provider should prompt the user for credentails in the event that the stored credentials have gone stale. if awithui is false, and the credentials are stale, the onstoprequest of the acallback nsirequestlistener will get the autherr status code passed to it. acallback the nsirequestobserver for monitoring the start and stop states of the refresh operation. deletefile() attempts to delete a file that had previously been uploaded using this instance. void deletefile(in nsilocalf...
... the desired password for the new account. afirstname the new account holder's first name. alastname the new account holder's last name. acallback the nsirequestobserver for monitoring the start and stop states of the new account creation operation. createexistingaccount() for an init'ed nsimsgcloudfileprovider, attempts to communicate with the service provider in order to get the proper credentials for starting uploads. void createexistingaccount(in nsirequestobserver acallback); parameters acallback the nsirequestobserver for monitoring the start and stop states of the creation operation. providerurlforerror() for an error code, for example uploadwouldexceedquota, a provider might have a url with information on how to deal with that error. this function translates those error cod...

Console messages - Firefox Developer Tools
ls. the x-content-security-policy and x-content-security-report-only headers will be deprecated in the future. please use the content-security-policy and content-security-report-only headers with csp spec compliant syntax instead. see content security policy for more details. password fields present on an insecure (http://) page. this is a security risk that allows user login credentials to be stolen. pages containing login forms must be served over https, not http. password fields present in a form with an insecure (http://) form action. this is a security risk that allows user login credentials to be stolen. forms containing password fields must submit them over https, not http. password fields present on an insecure (http://) iframe. this is a security ...
... iframes containing login forms must be served over https, not http. the site specified an invalid strict-transport-security header. see http strict transport security for more details. ...

AuthenticatorResponse.clientDataJSON - Web APIs
this property is only accessed on one of the child objects of authenticatorresponse, specifically authenticatorattestationresponse or authenticatorassertionresponse. syntax var arraybuffer = authenticatorattestationresponse.clientdatajson; var arraybuffer = authenticatorassertionresponse.clientdatajson; value an arraybuffer. ...
... recommendation initial definition. ...

FederatedCredential - Web APIs
a federated identity provider is an entity that a website trusts to correctly authenticate a user, and that provides an api for that purpose. openid connect is an example of a federated identity provider framework. in browsers that support it, an instance of this interface may be passed in the credential member of the init object for global fetch. constructor federatedcredential() creates a new federatedcredential object. properties inherits properties from its ancestor, credential. ...
... only returns a usvstring containing a credential's federated identity provider. federatedcredential.protocol read only returns a domstring containing a credential's federated identity protocol. event handlers none. methods none. examples var cred = new federatedcredential({ id: id, name: name, provider: 'https://account.google.com', iconurl: iconurl }); // store it navigator.credentials.store(cred) .then(function() { // do something else. }); specifications specification status comment credential management level 1 working draft initial definition. browser compatibility the compatibility table in this page is generated from structured data. if you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-...

Fetch API - Web APIs
nse is an http 404 or 500. instead, it will resolve normally (with ok status set to false), and it will only reject on network failure or if anything prevented the request from completing. fetch() won't can receive cross-site cookies; you can’t can establish a cross site session using fetch. set-cookie headers from other sites are silently ignored. ...
...t to false), and it will only reject on network failure or if anything prevented the request from completing. fetch() won't can receive cross-site cookies; you can’t can establish a cross site session using fetch. set-cookie headers from other sites are silently ignored. fetch() won’t send cookies, unless you set credentials: 'same-origin'. in august 2017, the spec changed the default credentials policy to 'same-origin'. the following browsers shipped and outdated native fetch, and were updated in these versions: firefox version 61.0b13. safari version 12. chrome version 68. if you are targetting older versions of these browsers, be sure to include credentials: 'same-origin' init option on all api requests that may be affected by cookies/user login state. ...

HTMLImageElement.crossOrigin - Web APIs
htmlimageelement.crossorigin = crossoriginmode; let crossoriginmode = htmlimageelement.crossorigin; value a domstring of a keyword specifying the cors mode to use when fetching the image resource. if you don't specify crossorigin, the image is fetched without cors (the fetch no-cors mode). permitted values are: anonymous requests by the <img> element have their mode set to cors and their credentials mode set to same-origin. this means that cors is enabled and credentials are sent if the image is fetched from the same origin from which the document was loaded. use-credentials requests by the htmlimageelement will use the cors mode and the include credentials mode; all image requests by the element will use cors, regardless of what domain the fetch is from. if crossorigin is an empty strin...
... javascript the code below demonstrates setting the crossorigin property on an <img> element to configure cors access for the fetch of a newly-created image. ...

PasswordCredential - Web APIs
}); specifications specification status comment credential management level 1 working draft initial definition. ...
...input type="password" name="password" autocomplete="current-password" /> <input type="hidden" name="csrf_token" value="*****" /> </form> then, a reference to this form element, using it to create a passwordcredential object, and storing it in the browser's password system. var form = document.queryselector('#form'); var creds = new passwordcredential(form); // store the credentials. navigator.credentials.store(creds) .then(function(creds) { // do something with the credentials if you need to. }); specifications specification status comment credential management level 1 working draft initial definition. ...

PasswordCredential - Web APIs
used from an <iframe>. constructor passwordcredential()secure context creates a new passwordcredential object. properties inherits properties from its ancestor, credential. passwordcredential.additionaldata secure context one of a formdata instance, a urlsearchparams instance, or null. the data in the objects will be added to the request body and sent to the remote endpoint with the credentials. passwordcredential.iconurl read only secure context a usvstring containing a url pointing to an image for an icon. this image is intended for display in a credential chooser. the url must be accessible without authentication. passwordcredential.idname secure context a usvstring containing the name that will be used for the id field when submitting the current object to a remote endpoint via...
...esenting the name that will be used for the password field when submitting the current object to a remote endpoint via fetch. this property defaults to 'password', but may be overridden to match whatever the backend service expects. event handlers none. methods none. examples var cred = new passwordcredential({ id: id, password: password, name: name, iconurl: iconurl }); navigator.credentials.store(cred) .then(function() { // do something else. }); specifications specification status comment credential management level 1 working draft initial definition. browser compatibility the compatibility table on this page is generated from structured data. if you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-...

PublicKeyCredential.id - Web APIs
mples var publickey = { challenge: new uint8array(26) /* this actually is given from the server */, rp: { name: "example corp", id : "login.example.com" }, user: { id: new uint8array(26), /* to be changed for each user */ name: "jdoe@example.com", displayname: "john doe", }, pubkeycredparams: [ { type: "public-key", alg: -7 } ] }; navigator.credentials.create({ publickey }) .then(function (newcredentialinfo) { var id = newcredentialinfo.id; // do something with the id // send attestation response and client extensions // to the server to proceed with the registration // of the credential }).catch(function (err) { console.error(err); }); specifications specification status comment we...
... recommendation specified in the context of publickeycredential. overrides the getter defined in credential. credential management level 1the definition of 'id' in that specification. working draft initial definition. ...

PublicKeyCredentialCreationOptions.challenge - Web APIs
onary is a buffersource used as a cryptographic challenge. this is randomly generated then sent from the relying party's server. this value (among other client data) will be signed by the authenticator, using its private key, and must be sent back for verification to the server as part of authenticatorattestationresponse.attestationobject. note: when the credential is retrieved with a navigator.credentials.get() call, the signature of the challenge is contained in authenticatorassertionresponse.signature. note: a challenge will be at least 16 bytes long. syntax challenge = publickeycredentialcreationoptions.challenge value a buffersource which is at least 16 bytes long. contains a cryptographic challenge emitted from the relying party's server which must be signed by the authenticator's pri...
...mples var publickey = { challenge: new uint8array(26) /* this actually is given from the server */, rp: { name: "example corp", id : "login.example.com" }, user: { id: new uint8array(26), /* to be changed for each user */ name: "jdoe@example.com", displayname: "john doe", }, pubkeycredparams: [ { type: "public-key", alg: -7 } ] }; navigator.credentials.create({ publickey }) .then(function (newcredentialinfo) { // send attestation response and client extensions // to the server to proceed with the registration // of the credential }).catch(function (err) { console.error(err); }); specifications specification status comment web authentication: an api for accessing public key credentials level 1...

RTCPeerConnection.setConfiguration() - Web APIs
rs configuration an rtcconfiguration object which provides the options to be set. the changes are not additive; instead, the new values completely replace the existing ones. exceptions invalidaccesserror one or more of the urls specified in configuration.iceservers is a turn server, but complete login information is not provided (that is, either the rtciceserver.username or rtciceserver.credentials is missing). this prevents successful login to the server. invalidmodificationerror the configuration includes changed identity information, but the connection already has identity information specified. this happens if configuration.peeridentity or configuration.certificates is set and their values differ from the current configuration. invalidstateerror the rtcpeerconnection is closed. syn...
... }] }; mypeerconnection.setconfiguration(restartconfig); mypeerconnection.createoffer({"icerestart": true}).then(function(offer) { return mypeerconnection.setlocaldescription(offer); }) .then(function() { // send the offer to the other peer using the signaling server }) .catch(reporterror); first, a new rtcconfiguration is created, restartconfig, specifying the new ice server and its credentials. this is then passed into setconfiguration(). ice negotiation is restarted by calling createoffer(), specifying true as the value of the icerestart option. from there, we handle the process as usual, by setting the local description to the returned offer and then sending that offer to the other peer. specifications specification status comment webrtc 1.0: real-time commu...

Request() - Web APIs
aders object or an object literal with bytestring values. body: any body that you want to add to your request: this can be a blob, buffersource, formdata, urlsearchparams, usvstring, or readablestream object. note that a request using the get or head method cannot have a body. mode: the mode you want to use for the request, e.g., cors, no-cors, same-origin, or navigate. the default is cors. credentials: the request credentials you want to use for the request: omit, same-origin, or include. the default is same-origin. cache: the cache mode you want to use for the request. redirect: the redirect mode to use: follow, error, or manual. the default is follow. referrer: a usvstring specifying no-referrer, client, or a url. the default is about:client. integrity: contains the subresource integ...
...rror, or manual. the default is follow. referrer: a usvstring specifying no-referrer, client, or a url. the default is about:client. integrity: contains the subresource integrity value of the request (e.g., sha256-bpfbw7ivv8q2jlit13fxdyae2tjllusrsz273h2nfse=). errors type description typeerror since firefox 43, request() will throw a typeerror if the url has credentials, such as http://user:password@example.com. example in our fetch request example (see fetch request live) we create a new request object using the constructor, then fetch it using a globalfetch.fetch call. since we are fetching an image, we run body.blob on the response to give it the proper mime type so it will be handled properly, then create an object url of it and display it in an <img...

Attestation and Assertion - Web APIs
this provides a root of trust for a newly generated key pair as well as being able to identify the attributes of a device being used (how the private key is protected; if / what kind of biometric is being used; whether a device has been certified; et...
...asked to authenticate. authenticatordata - data created and/or used by the authenticator signature - a signature over the clientdatajson and authenticatordata that can be verified with the public key that was created during registration. userhandle - optional. (nullable) a user identifier. this may be a username, or a hash of a username, etc. used by a service to give a scope to credentials. maximum length of 64 bytes. older authenticators (u2f) do not support this output. it's important to highlight that the signature for assertion uses a different key pair than attestation. an assertion is signed using the key pair for a service, which was generated during registration. an attestation is signed using the attestation private key and attestation certificate that were burned into...

Worklet.addModule() - Web APIs
e addmodule() method of the worklet interface loads the module in the given javascript file and adds it to the current worklet. syntax addpromise = worklet.addmodule(moduleurl); addpromise = worklet.addmodule(moduleurl, options); parameters moduleurl a string containing the url of a javascript file with the module to add. options optional an object with any of the following options: credentials: a requestcredentials value that indicates whether to send credentials (e.g. cookies and http authentification) when loading the module. can be one of "omit", "same-origin", or "include". defaults to "same-origin". see also request.credentials. return value a promise that resolves once the module from the given url has been added. the promise doesn't return any value. exceptions if addmo...
...odule() fails, it rejects the promise, delivering one of the following errors to the rejection handler. aborterror the specified script is invalid or could not be loaded. syntaxerror the specified moduleurl is invalid. ...

<audio>: The Embed Audio element - HTML: Hypertext Markup Language
ribute indicates whether to use cors to fetch the related audio file. cors-enabled resources can be reused in the <canvas> element without being tainted. the allowed values are: anonymous sends a cross-origin request without a credential. in other words, it sends the origin: http header without a cookie, x.509 certificate, or performing http basic authentication. ...
... the allowed values are: anonymous sends a cross-origin request without a credential. in other words, it sends the origin: http header without a cookie, x.509 certificate, or performing http basic authentication. if the server does not give credentials to the origin site (by not setting the access-control-allow-origin: http header), the image will be tainted, and its usage restricted. use-credentials sends a cross-origin request with a credential. in other words, it sends the origin: http header with a cookie, a certificate, or performing http basic authentication. if the server does not give credentials to the origin site (through access-control-allow-credentials: http header), the image will be tainted and its usage restricted. when not present, the resource is fetched without a cors r...

<img>: The Image Embed element - HTML: Hypertext Markup Language
o the image data by the origin site (by not sending any access-control-allow-origin response header, or by not including the site's origin in any access-control-allow-origin response header it does send), then the browser marks the image as tainted and restricts access to its image data, preventing its usage in <canvas> elements. ...
...r by not including the site's origin in any access-control-allow-origin response header it does send), then the browser marks the image as tainted and restricts access to its image data, preventing its usage in <canvas> elements. allowed values: anonymous a cors request is sent with credentials omitted (that is, no cookies, x.509 certificates, or authorization request header). use-credentials the cors request is sent with any credentials included (that is, cookies, x.509 certificates, and the authorization request header). if the server does not opt into sharing credentials with the origin site (by sending back the access-control-allow-credentials: true response header), then the browser marks the image as tainted and restricts access to its image data. if the attribute has an i...

<link>: The External Resource Link element - HTML: Hypertext Markup Language
s enumerated attribute indicates whether cors must be used when fetching the resource. cors-enabled images can be reused in the <canvas> element without being tainted. the allowed values are: anonymous a cross-origin request (i.e. with an origin http header) is performed, but no credential is sent (i.e. no cookie, x.509 certificate, or http basic authentication). ...
...being tainted. the allowed values are: anonymous a cross-origin request (i.e. with an origin http header) is performed, but no credential is sent (i.e. no cookie, x.509 certificate, or http basic authentication). if the server does not give credentials to the origin site (by not setting the access-control-allow-origin http header) the resource will be tainted and its usage restricted. use-credentials a cross-origin request (i.e. with an origin http header) is performed along with a credential sent (i.e. a cookie, certificate, and/or http basic authentication is performed). if the server does not give credentials to the origin site (through access-control-allow-credentials http header), the resource will be tainted and its usage restricted. if the attribute is not present, the resource is...

<video>: The Video Embed element - HTML: Hypertext Markup Language
d attribute indicates whether to use cors to fetch the related image. cors-enabled resources can be reused in the <canvas> element without being tainted. the allowed values are: anonymous sends a cross-origin request without a credential. in other words, it sends the origin: http header without a cookie, x.509 certificate, or performing http basic authentication. ...
... the allowed values are: anonymous sends a cross-origin request without a credential. in other words, it sends the origin: http header without a cookie, x.509 certificate, or performing http basic authentication. if the server does not give credentials to the origin site (by not setting the access-control-allow-origin: http header), the image will be tainted, and its usage restricted. use-credentials sends a cross-origin request with a credential. in other words, it sends the origin: http header with a cookie, a certificate, or performing http basic authentication. if the server does not give credentials to the origin site (through access-control-allow-credentials: http header), the image will be tainted and its usage restricted. when not present, the resource is fetched without a cors r...

Reason: CORS header 'Access-Control-Allow-Origin' missing - HTTP
access-control-allow-origin: https://amazing.site you can also configure a site to allow any site to access it by using the * wildcard. you should only use this for public apis. private apis should never use *, and should instead have a specific domain or domains set. ...
...in or domains set. in addition, the wildcard only works for requests made with the crossorigin attribute set to anonymous, and it prevents sending credentials like cookies in requests. access-control-allow-origin: * warning: using the wildcard to allow all sites to access a private api is a bad idea. to allow any site to make cors requests without using the * wildcard (for example, to enable credentials), your server must read the value of the request's origin header and use that value to set access-control-allow-origin, and must also set a vary: origin header to indicate that some headers are being set dynamically depending on the origin. the exact directive for setting headers depends on your web server. in apache, add a line such as the following to the server's configuration (within the app...

Access-Control-Expose-Headers - HTTP
no syntax access-control-expose-headers: <header-name>, <header-name>, ... access-control-expose-headers: * directives <header-name> a list of exposed headers consisting of zero or more header names other than the cors-safelisted request headers that the resource might use and can be exposed. * (wildcard) the value "*" only counts as a special wildcard value for requests without credentials (requests without http cookies or http authentication information). in requests with credentials, it is treated as the literal header name "*" without special semantics. note that the authorization header can't be wildcarded and always needs to be listed explicitly. examples to expose a non-cors-safelisted request header, you can specify: access-control-expose-headers: content-length to add...
...ion header can't be wildcarded and always needs to be listed explicitly. examples to expose a non-cors-safelisted request header, you can specify: access-control-expose-headers: content-length to additionally expose a custom header, like x-kuma-revision, you can specify multiple headers separated by a comma: access-control-expose-headers: content-length, x-kuma-revision in requests without credentials, you can also use a wildcard value: access-control-expose-headers: * however, this won't wildcard the authorization header, so if you need to expose that, you will need to list it explicitly: access-control-expose-headers: *, authorization specifications specification status comment fetchthe definition of 'access-control-expose-headers' in that specification. l...

Authorization - HTTP
the http authorization request header contains the credentials to authenticate a user agent with a server, usually, but not necessarily, after the server has responded with a 401 unauthorized status and the www-authenticate header. header type request header forbidden header name no syntax authorization: <type> <credentials> directives <type> authentication type. a common type is "basic". other types: iana registry of authentication schemes authentification for aws servers (aws4-hmac-sha256) <credentials> if the "basic" authentication scheme is used, the credentials are constructed like this: the username and the password are combined with a colon (aladdin:opensesame). the resulting string is base64 encoded (ywxhzgrpbjpvcgvuc2vzyw1l). not...
...prefer to use https in conjunction with basic authentication. examples authorization: basic ywxhzgrpbjpvcgvuc2vzyw1l see also http authentication for examples on how to configure apache or nginx servers to password protect your site with http basic authentication. ...

HTTP headers - HTTP
nd caches must store them. hop-by-hop headers these headers are meaningful only for a single transport-level connection, and must not be retransmitted by proxies or cached. note that only hop-by-hop headers may be set using the connection general header. authentication www-authenticate defines the authentication method that should be used to access a resource. authorization contains the credentials to authenticate a user-agent with a server. proxy-authenticate defines the authentication method that should be used to access a resource behind a proxy server. proxy-authorization contains the credentials to authenticate a user agent with a proxy server. caching age the time, in seconds, that the object has been in a proxy cache. cache-control directives for caching mechanisms in bot...
...user-agent. cookie2 contains an http cookie previously sent by the server with the set-cookie2 header, but has been obsoleted. use cookie instead. set-cookie2 sends cookies from the server to the user-agent, but has been obsoleted. use set-cookie instead. cors learn more about cors here. access-control-allow-origin indicates whether the response can be shared. access-control-allow-credentials indicates whether the response to the request can be exposed when the credentials flag is true. access-control-allow-headers used in response to a preflight request to indicate which http headers can be used when making the actual request. access-control-allow-methods specifies the methods allowed when accessing the resource in response to a preflight request. access-control-expose-headers ...

Grammar and types - JavaScript
see string for details on string objects. using special characters in strings in addition to ordinary characters, you can also include special characters in strings, as shown in the following example. 'one line \n anothe...
...see string for details on string objects. using special characters in strings in addition to ordinary characters, you can also include special characters in strings, as shown in the following example. 'one line \n another line' the f...

Insecure passwords - Web security
d by sniffing the network, or by modifying the served page in transit. the https protocol is designed to protect user data from eavesdropping (confidentiality) and from modification (integrity) on the network. websites that handle user data should use https to protect their users from attackers. if a website uses http instead of https, it is trivial to steal user information (such as their login credentials). this was famously demonstrated by firesheep. to fix this issue, install and configure an ssl/tls certificate onto your server. there are various vendors offering free and paid certificates. if you are using a cloud platform, it may have its own ways of enabling https. note on password reuse sometimes websites require username and passwords but don't actually store data that is very sensitive...
...rm, it may have its own ways of enabling https. note on password reuse sometimes websites require username and passwords but don't actually store data that is very sensitive. for example, a news site may save which news articles a user wants to go back to and read, but not save any other data about a user. web developers of the news site may be less motivated to secure their site and their user credentials. unfortunately, password reuse is a big problem. users use the same password across multiple sites (news websites, social networks, email providers, banks). hence, even if access to the username and password to your site doesn't seem like a huge risk to you, it is a great risk to users who have used the same username and password to log in to their bank accounts. attackers are getting smarter; t...

Types of attacks - Web security
this article describes various types of security attacks and techniques to mitigate them. click-jacking click-jacking is the practice of tricking a user into clicking on a link, button, etc. that is other than what the user thinks it is. this can be used, for example, to steal login credentials or to get the user's unwitting permission to install a piece of malware. (click-jacking is sometimes called "user interface redressing", though this is a misuse of the term "redress".) cross-site request forgery (csrf) cross-site scripting (xss) cross-site scripting (xss) is a security exploit which allows an attacker to inject into a website malicious client-side code. this code is executed by the victims and lets the attackers bypass access controls and impersonate users. according to the open web ap...
... ensures all browsers are protected and provides protection where samesite cookies cannot help (such as attacks originating from a separate subdomain). for more prevention tips, see the owasp csrf prevention cheat sheet. man-in-the-middle (mitm) a third party intercepts traffic between a web server and a client (browser), and impersonates the web server in order to capture data (such as login credentials or credit card information). the traffic is passed through, possibly with alterations. open wifi networks are a typically means of executing this attack. session hijacking session hijacking consists of gaining access to and misusing a user's authenticated session. this may happen by stealing a cookie for an existing session, or by fooling the user (or their browser) into setting a cookie with a...

High-Level APIs - Archive of obsolete content
fications display transient, toaster-style desktop messages to the user. page-mod run scripts in the context of web pages whose url matches a given pattern. page-worker create a permanent, invisible page and access its dom. panel creates transient dialogs to implement part of an add-on's user interface. passwords interact with firefox's password manager to add, retrieve and remove stored credentials. private-browsing check whether a given object is private, so an add-on can respect private browsing querystring utility functions for working with query strings. request make simple network requests. selection get and set text and html selections in the current web page. self access data that is bundled with the add-on, and add-on metadata. simple-prefs store preferences acro...

HTTP Class Overview - Archive of obsolete content
ttpchunkeddecoder owned by a transaction strips chunked transfer encoding nshttprequesthead owns a nshttpheaderarray knows how to fill a request buffer nshttpresponsehead owns a nshttpheaderarray knows how to parse response lines performs common header manipulations/calculations nshttpheaderarray stores http "<header>:<value>" pairs nshttpauthcache stores authentication credentials for http auth domains nshttpbasicauth implements nsihttpauthenticator generates basic auth credentials from user:pass nshttpdigestauth implements nsihttpauthenticator generates digest auth credentials from user:pass original document information author(s): darin fisher last updated date: august 5, 2002 copyright information: portions of this content are © 1998–2007 by indiv...

CORS - MDN Web Docs Glossary: Definitions of Web-related terms
icy forbids cross-origin access to resources. but cors gives web servers the ability to say they want to opt into allowing cross-origin access to their resources. learn more general knowledge cross-origin resource sharing (cors) on mdn cross-origin resource sharing on wikipedia cors headers access-control-allow-origin indicates whether the response can be shared. access-control-allow-credentials indicates whether or not the response to the request can be exposed when the credentials flag is true. access-control-allow-headers used in response to a preflight request to indicate which http headers can be used when making the actual request. access-control-allow-methods specifies the method or methods allowed when accessing the resource in response to a preflight request. access-contro...

Index - MDN Web Docs Glossary: Definitions of Web-related terms
rity and trustworthiness. 70 challenge-response authentication security in security protocols, a challenge is some data sent to the client by the server in order to generate a different response each time. challenge-response protocols are one way to fight against replay attacks where an attacker listens to the previous messages and resends them at a later time to get the same credentials as the original message. 71 character codingscripting, glossary, strings a character is either a symbol (letters, numbers, punctuation) or non-printing "control" (e.g., carriage return or soft hyphen). utf-8 is the most common character set and includes the graphemes of the most popular human languages. 72 character encoding composing, glossary an encodi...

Challenge-response authentication - MDN Web Docs Glossary: Definitions of Web-related terms
in security protocols, a challenge is some data sent to the client by the server in order to generate a different response each time. challenge-response protocols are one way to fight against replay attacks where an attacker listens to the previous messages and resends them at a later time to get the same credentials as the original message. the http authentication protocol is challenge-response based, though the "basic" protocol isn't using a real challenge (the realm is always the same). learn more challenge-response authentication on wikipedia. ...

Setting up your own test automation environment - Learn web development
examples showing how to set up different combinations of test/assertion tools. running remote tests it turns out that running tests on remote servers isn't that much more difficult than running them locally. you just need to create your driver instance, but with a few more features specified, including the capabilities of the browser you want to test on, the address of the server, and the user credentials you need (if any) to access it. lambdatest getting selenium tests to run remotely on lambdatest is very simple. the code you need should follow the pattern seen below. let's write an example: inside your project directory, create a new file called lambdatest_google_test.js give it the following contents: const webdriver = require('selenium-webdriver'); by = webdriver.by, until = ...

mozbrowserusernameandpasswordrequired
dards track. do not use it on production sites facing the web: it will not work for every user. there may also be large incompatibilities between implementations and the behavior may change in the future. the mozbrowserusernameandpasswordrequired event is fired when the content within a browser <iframe> requires an http authentification. the embedder is supposed to retrieve the necessary credentials, usually using a dialog or a database of username/passwords, and then call authenticate() or cancel() as appropriate. general info specification non standard interface customevent bubbles yes cancelable yes target <iframe> default action none properties property type description target read only eventtarget the browser iframe type read...

Integrated Authentication
interact. configuration by default, mozilla rejects all spnego challenges from a web server. this is to protect the user from the possibility of dns-spoofing being used to stage a man-in-the-middle exploit (see bug 17578 for more info). moreover, with windows clients ntlm may be negotiated as the authentication protocol. so, it is paramount that the browser does not freely exchange ntlm user credentials with any server that requests them. the ntlm response includes a hash of the user's logon credentials. on older versions of windows this hash is computed using a relatively weak algorithm (see hertel for more info on ntlm authentication). mozilla currently supports a whitelist of sites that are permitted to engage in spnego authentication with the browser. this list is intended to be configured ...

SVN for Localizers
mmit. once you're satisfied with changes, commit them to the appropriate mozilla svn repository by entering the following command: svn commit -m "minor modifications for firefox [version #] beta page for [your locale]" the svn commit command will commit your changes directly to the mozilla svn repositories. since you are writing to the repository here, you will be asked for your ldap login credentials. the -m parameter followed by some text within double quotes (") will be pushed along with your changes. within the double quotes you should briefly describe your changes so that everyone can see what you contributed. you can also double check your changes using the viewvc interface. after you commit your changes, wait 15 minutes and check the staging website for your locale. your recent cha...

NSS 3.45 release notes
- finds all certificates on the given slot with the given subject distinguished name and returns them as der bytes. if no such certificates can be found, returns secsuccess and sets *results to null. if a failure is encountered while fetching any of the matching certificates, secfailure is returned and *results will be null. notable changes in nss 3.45 bug 1540403 - implement delegated credentials (draft-ietf-tls-subcerts) this adds a new experimental function: ssl_delegatecredential note: in 3.45, selfserv does not yet support delegated credentials. see bug 1548360. note: in 3.45 the sslchannelinfo is left unmodified, while an upcoming change in 3.46 will set sslchannelinfo.authkeybits to that of the delegated credential for better policy enforcement. see bug 1563078. b...

NSS 3.46 release notes
563258 - fips.sh fails due to non-existent "resp" directories bug 1561598 - remove -wmaybe-uninitialized warning in pqg.c bug 1560806 - increase softoken password max size to 500 characters bug 1568776 - output paths relative to repository in nss coverity bug 1453408 - modutil -changepw fails in fips mode if password is an empty string bug 1564727 - use a pss spki when possible for delegated credentials bug 1493916 - fix ppc64 inline assembler for clang bug 1561588 - remove -wmaybe-uninitialized warning in p7env.c bug 1561548 - remove -wmaybe-uninitialized warning in pkix_pl_ldapdefaultclient.c bug 1512605 - incorrect alert description after unencrypted finished msg bug 1564715 - read /proc/cpuinfo when at_hwcap2 returns 0 bug 1532194 - remove or fix -ddebug_$user from make builds bug 156...

NSS 3.52 release notes
e nss_disable_gcm_arm32_neon to build on arm32 without neon support. bug 1619102 - add workaround option to include both dtls and tls versions in dtls supported_versions. bug 1619056 - update readme: tls 1.3 is not experimental anymore. bug 1618915 - fix ubsan issue in ssl_parsesessionticket. bug 1618739 - don't assert fuzzer behavior in ssl_parsesessionticket. bug 1617968 - update delegated credentials implementation to draft-07. bug 1617533 - update hacl* dependencies for libintvector.h bug 1613238 - add vector accelerated sha2 for power 8+. bug 1612493 - integrate avx2 chacha20, poly1305, and chacha20poly1305 from hacl*. bug 1612281 - maintain pkcs11 c_getattributevalue semantics on attributes that lack nss database columns. bug 1612260 - add wycheproof rsa test vectors. bug 1608250 - b...

Secure Development Guidelines
xss: example the following snippet of javascript: document.write("welcome to " + document.location); ... is exploitable (in some browsers) with a simple request such as: http://www.victim.com?something=<script>alert('oops')</script> xss: prevention escape all dynamic input that will be sent back to the user html encoding ...

imgILoader
imgirequest loadimage( in nsiuri auri, in nsiuri ainitialdocumenturl, in nsiuri areferreruri, in nsiprincipal aloadingprincipal, in nsiloadgroup aloadgroup, in imgidecoderobserver aobserver, in nsisupports acx, in nsloadflags aloadflags, in nsisupports cachekey, in imgirequest arequest, in nsichannelpolic...

imgIRequest
been decoded. cors_none 1 cors modes images can be loaded with. by default, all images are loaded with cors_none and cannot be used cross-origin in context like webgl. if an html img element has the crossorigin attribute set, the imgirequest will be validated for cross-origin usage with cors, and, if successful, will have its cors mode set to the relevant type. cors_anonymous 2 cors_use_credentials 3 methods cancelandforgetobserver() cancels this request as in nsirequest.cancel(); further, also nulls out decoderobserver so it gets no further notifications from us. note: you should not use this in any new code; instead, use cancel(). note that cancel() is asynchronous, which means that some time after you call it, the listener/observer will get an onstoprequest(). this means that, if you...

nsISocketProvider
s constant value description proxy_resolves_host 1 << 0 this flag is set if the proxy is to perform hostname resolution instead of the client. when set, the hostname parameter passed in this interface will be used instead of the address structure passed for a later request. anonymous_connect 1 << 1 when setting this flag, the socket will not apply any credentials when establishing a connection. for example, an ssl connection would not send any client-certificates if this flag is set. methods native code only!addtosocket this function is called to allow the socket provider to layer a prfiledesc (a file descriptor) on top of another prfiledesc. for example, ssl via a socks proxy. parameters are the same as newsocket() with the exception of afiledesc,...

nsISocketTransport
ues for the connectionflags attribute constant value description bypass_cache 0 when making a new connection bypass_cache will force the necko dns cache entry to be refreshed with a new call to nspr if it is set before opening the new stream. anonymous_connect 1 when this flag is set, the socket will not apply any credentials when establishing a connection. for example, an ssl connection would not send any client-certificates if this flag is set. disable_ipv6 2 when this flag is set, the socket will ignore any ipv6 addresses the host may offer and will only attempt to connect to ipv4 addresses. methods native code only!getpeeraddr returns the ip address of the socket connection p...

Document.execCommand() - Web APIs
s mode, it affects the background color of the containing block instead. this requires a <color> value string to be passed in as a value argument. note that internet explorer uses this to set the text background color. bold toggles bold on/off for the selection or at the insertion point. internet explorer uses the <strong> tag instead of <b>. clearauthenticationcache clears all authentication credentials from the cache. contentreadonly makes the content document either read-only or editable. this requires a boolean true/false as the value argument. (not supported by internet explorer.) copy copies the current selection to the clipboard. conditions of having this behavior enabled vary from one browser to another, and have evolved over time. check the compatibility table to determine if you can...

EventSource() - Web APIs
the eventsource() constructor returns a newly-created eventsource, which represents a remote resource. syntax eventsource = new eventsource(url, configuration); parameters url a usvstring that represents the location of the remote resource serving the events/messages. configuration optional provides options to configure the new connection. the possible entries are: withcredentials, defaulting to false, indicating if cors should be set to include credentials. examples var evtsource = new eventsource('sse.php'); var eventlist = document.queryselector('ul'); evtsource.onmessage = function(e) { var newelement = document.createelement("li"); newelement.textcontent = "message: " + e.data; eventlist.appendchild(newelement); } note: you can find a full example on github — see...

Navigator - Web APIs
useragent read only returns the user agent string for the current browser. navigator.xr read only returns xr object, which represents the entry point into the webxr api. non-standard navigator.buildid returns the build identifier of the browser. in modern browsers this property now returns a fixed timestamp as a privacy measure, e.g. 20181001000000 in firefox 64 onwards. navigator.credentials returns the credentialscontainer interface which exposes methods to request credentials and notify the user agent when interesting events occur such as successful sign in or sign out. navigator.devicememory read only returns the amount of device memory in gigabytes. this value is an approximation given by rounding to the nearest power of 2 and dividing that number by 1024. navigator.don...

PaymentResponse.complete() - Web APIs
payment information to a secure server using the fetch api. it calls complete() with an answer appropriate to the status in the response. // initialization of paymentrequest arguments are excerpted for the // sake of brevity. ...

Using the Payment Request API - Web APIs
users can make payments checking whether users can make payments is always useful. here's a couple of related techniques. customizing the payment button one useful technique to employ is customizing the payment request button depending on whether users can make payments. in the following snippet we do just this — depending on whether the user can make a fast payment or needs to add payment credentials first, the title of the checkout button changes between "fast checkout with w3c" and "setup w3c checkout". in both cases, the checkout button calls paymentrequest.show(). const checkoutbutton = document.getelementbyid('checkout-button'); checkoutbutton.innertext = "loading..."; if (window.paymentrequest) { let request = new paymentrequest(buildsupportedpaymentmethodnames(), buildshopping...

Payment Request API - Web APIs
alizing the ui into the user's preferred language. accessibility: as the browser controls the input elements of the payment sheet, it can assure consistent keyboard and screen reader accessibility on every website without developers needing to do anything. a browser could also adjust the font size or color contrast of the payment sheet, making it more comfortable for the user to make a payment. credentials management: users can manage their credit cards and shipping addresses directly in the browser. a browser can also sync these "credentials" across devices, making it easy for users to jump from desktop to mobile and back again when buying things. consistent error handling: the browser can check the validity of card numbers, and can tell the user if a card has expired (or is about to expire). the...

PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable() - Web APIs
recommendation initial definition. ...

PublicKeyCredentialCreationOptions.attestation - Web APIs
attestation: "indirect", challenge: new uint8array(26) /* this actually is given from the server */, rp: { name: "example corp", id : "login.example.com" }, user: { id: new uint8array(26), /* to be changed for each user */ name: "jdoe@example.com", displayname: "john doe", }, pubkeycredparams: [ { type: "public-key", alg: -7 } ] }; navigator.credentials.create({ publickey }) .then(function (newcredentialinfo) { // send attestation response and client extensions // to the server to proceed with the registration // of the credential }).catch(function (err) { console.error(err); }); specifications specification status comment web authentication: an api for accessing public key credentials level 1...

PublicKeyCredentialCreationOptions.authenticatorSelection - Web APIs
userverification: "required" }, challenge: new uint8array(26) /* this actually is given from the server */, rp: { name: "example corp", id : "login.example.com" }, user: { id: new uint8array(26), /* to be changed for each user */ name: "jdoe@example.com", displayname: "john doe", }, pubkeycredparams: [ { type: "public-key", alg: -7 } ] }; navigator.credentials.create({ publickey }) .then(function (newcredentialinfo) { // send attestation response and client extensions // to the server to proceed with the registration // of the credential }).catch(function (err) { console.error(err); }); specifications specification status comment web authentication: an api for accessing public key credentials level 1...

PublicKeyCredentialCreationOptions.pubKeyCredParams - Web APIs
ot, then we will fallback on an rsa algorithm { type: "public-key", alg: -37 } ], challenge: new uint8array(26) /* this actually is given from the server */, rp: { name: "example corp", id : "login.example.com" }, user: { id: new uint8array(26), /* to be changed for each user */ name: "jdoe@example.com", displayname: "john doe", } }; navigator.credentials.create({ publickey }) .then(function (newcredentialinfo) { // send attestation response and client extensions // to the server to proceed with the registration // of the credential }).catch(function (err) { console.error(err); }); specifications specification status comment web authentication: an api for accessing public key credentials level 1...

RTCPeerConnection.createOffer() - Web APIs
sscallback, failurecallback, [options]) parameters options optional an rtcofferoptions dictionary providing options requested for the offer. rtcofferoptions dictionary the rtcofferoptions dictionary is used to customize the offer created by this method. icerestart optional to restart ice on an active connection, set this to true. this will cause the returned offer to have different credentials than those already in place. if you then apply the returned offer, ice will restart. specify false to keep the same credentials and therefore not restart ice. the default is false. offertoreceiveaudio optional (legacy) a legacy boolean option which used to control whether or not to offer to the remote peer the opportunity to try to send audio. if this value is false, the remote peer will not be...

RTCPeerConnection.restartIce() - Web APIs
es until an ice restart has been successfully completed. syntax rtcpeerconnection.restartice(); parameters none. return value undefined. usage notes after calling restartice(), the next offer created using createoffer() will initiate ice restart once sent to the remote peer over your signaling mechanism. restarting ice essentially resets ice so that it creates all new candidates using new credentials. existing media transmissions continue uninterrupted during this process. for details about how ice restart works, see ice restart in lifetime of a webrtc session and rfc 5245, section 9.1.1.1: ice specification. example this example creates a handler for the iceconnectionstatechange event that handles a transition to the failed state by restarting ice in order to try again. pc.addeventlisten...

Using server-sent events - Web APIs
ith the url of a script that generates the events. for example: const evtsource = new eventsource("ssedemo.php"); if the event generator script is hosted on a different origin, a new eventsource object should be created with both the url and an options dictionary. ...

SharedWorker() - Web APIs
sharedworkerglobalscope representing the scope of the worker, which is mainly useful for debugging purposes. options optional an object containing option properties that can set when creating the object instance. available properties are as follows: type: a domstring specifying the type of worker to create. the value can be classic or module. if not specified, the default used is classic. credentials: a domstring specifying the type of credentials to use for the worker. the value can be omit, same-origin, or include. if not specified, or if type is classic, the default used is omit (no credentials required). name: a domstring specifying an identifying name for the sharedworkerglobalscope representing the scope of the worker, which is mainly useful for debugging purposes. return value ...

Worker() - Web APIs
svstring representing the url of the script the worker will execute. it must obey the same-origin policy. options optional an object containing option properties that can be set when creating the object instance. available properties are as follows: type: a domstring specifying the type of worker to create. the value can be classic or module. if not specified, the default used is classic. credentials: a domstring specifying the type of credentials to use for the worker. the value can be omit, same-origin, or include. if not specified, or if type is classic, the default used is omit (no credentials required). name: a domstring specifying an identifying name for the dedicatedworkerglobalscope representing the scope of the worker, which is mainly useful for debugging purposes. exceptions...

XMLHttpRequest() - Web APIs
). setting the mozanon flag to true effectively resembles the anonxmlhttprequest() constructor described in older versions of the xmlhttprequest specification. const request = new xmlhttprequest(paramsdictionary); parameters (non-standard) objparameters there are two flags you can set: mozanon boolean: setting this flag to true will cause the browser not to expose the origin and user credentials when fetching resources. most important, this means that cookies will not be sent unless explicitly added using setrequestheader. mozsystem boolean: setting this flag to true allows making cross-site connections without requiring the server to opt-in using cors. requires setting mozanon: true, i.e. this can't be combined with sending cookies or other user credentials. this only works in privi...

XMLHttpRequest - Web APIs
ded in an http/1.1 status line. xmlhttprequest.timeout is an unsigned long representing the number of milliseconds a request can take before automatically being terminated. xmlhttprequesteventtarget.ontimeout is an eventhandler that is called whenever the request times out. xmlhttprequest.upload read only is an xmlhttprequestupload, representing the upload process. xmlhttprequest.withcredentials is a boolean that indicates whether or not cross-site access-control requests should be made using credentials such as cookies or authorization headers. non-standard properties xmlhttprequest.channelread only is a nsichannel. the channel used by the object when performing the request. xmlhttprequest.mozanonread only is a boolean. if true, the request will be sent without cookie and aut...

Web APIs
canvaspattern canvasrenderingcontext2d caretposition channelmergernode channelsplitternode characterdata childnode client clients clipboard clipboardevent clipboarditem closeevent comment compositionevent constantsourcenode constrainboolean constraindomstring constraindouble constrainulong contentindex contentindexevent convolvernode countqueuingstrategy crashreportbody credential credentialscontainer crypto cryptokey cryptokeypair customelementregistry customevent d domconfiguration domerror domexception domhighrestimestamp domimplementation domimplementationlist domlocator dommatrix dommatrixreadonly domobject domparser dompoint dompointinit dompointreadonly domquad domrect domrectreadonly domstring domstringlist domstringmap domtimestamp domtokenlist domuserdata ...

<button>: The Button element - HTML: Hypertext Markup Language
orm owner. formmethod html5 if the button is a submit button (it's inside/associated with a <form> and doesn't have type="button"), this attribute specifies the http method used to submit the form. possible values: post: the data from the form are included in the body of the http request when sent to the server. use when the form contains information that shouldn’t be public, like login credentials. get: the form data are appended to the form's action url, with a ? as a separator, and the resulting url is sent to the server. use this method when the form has no side effects, like search forms. if specified, this attribute overrides the method attribute of the button's form owner. formnovalidate html5 if the button is a submit button, this boolean attribute specifies that the form ...

Reason: Credential is not supported if the CORS header ‘Access-Control-Allow-Origin’ is ‘*’ - HTTP
reason reason: credential is not supported if the cors header ‘access-control-allow-origin’ is ‘*’ what went wrong? the cors request was attempted with the credentials flag set, but the server is configured using the wildcard ("*") as the value of access-control-allow-origin, which doesn't allow the use of credentials. to correct this problem on the client side, simply ensure that the credentials flag's value is false when issuing your cors request. if the request is being issued using xmlhttprequest, make sure you're not setting withcredentials to true. if using server-sent events, make sure eventsource.withcredentials is false (it's the default value). if using the fetch api, make sure request.credentials is "omit". if, instead, you need to adjust the server's behavior, you'll n...

CORS errors - HTTP
not http reason: cors header ‘access-control-allow-origin’ missing reason: cors header ‘access-control-allow-origin’ does not match ‘xyz’ reason: credential is not supported if the cors header ‘access-control-allow-origin’ is ‘*’ reason: did not find method in cors header ‘access-control-allow-methods’ reason: expected ‘true’ in cors header ‘access-control-allow-credentials’ reason: cors preflight channel did not succeed reason: invalid token ‘xyz’ in cors header ‘access-control-allow-methods’ reason: invalid token ‘xyz’ in cors header ‘access-control-allow-headers’ reason: missing token ‘xyz’ in cors header ‘access-control-allow-headers’ from cors preflight channel reason: multiple cors header ‘access-control-allow-origin’ not all...

Access-Control-Allow-Headers - HTTP
ader type response header forbidden header name no syntax access-control-allow-headers: <header-name>[, <header-name>]* access-control-allow-headers: * directives <header-name> the name of a supported request header. the header may list any number of headers, separated by commas. * (wildcard) the value "*" only counts as a special wildcard value for requests without credentials (requests without http cookies or http authentication information). in requests with credentials, it is treated as the literal header name "*" without special semantics. note that the authorization header can't be wildcarded and always needs to be listed explicitly. examples a custom header here's an example of what an access-control-allow-headers header might look like. it indicates that in ...

Access-Control-Allow-Methods - HTTP
e resource in response to a preflight request. header type response header forbidden header name no syntax access-control-allow-methods: <method>, <method>, ... access-control-allow-methods: * directives <method> comma-delimited list of the allowed http request methods. * (wildcard) the value "*" only counts as a special wildcard value for requests without credentials (requests without http cookies or http authentication information). in requests with credentials, it is treated as the literal method name "*" without special semantics. examples access-control-allow-methods: post, get, options access-control-allow-methods: * specifications specification status comment fetchthe definition of 'access-control-allow-methods' in that...

Access-Control-Allow-Origin - HTTP
the access-control-allow-origin response header indicates whether the response can be shared with requesting code from the given origin. header type response header forbidden header name no syntax access-control-allow-origin: * access-control-allow-origin: <origin> access-control-allow-origin: null directives * for requests without credentials, the literal value "*" can be specified, as a wildcard; the value tells browsers to allow requesting code from any origin to access the resource. attempting to use the wildcard with credentials will result in an error. <origin> specifies an origin. only a single origin can be specified. if the server supports clients from multiple origins, it must return the origin for the specific client making the request. null spec...

Clear-Site-Data - HTTP
t the server wishes to remove locally cached data (i.e. the browser cache, see http caching) for the origin of the response url. depending on the browser, this might also clear out things like pre-rendered pages, script caches, webgl shader caches, or address bar suggestions. "cookies" indicates that the server wishes to remove all cookies for the origin of the response url. http authentication credentials are also cleared out. this affects the entire registered domain, including subdomains. so https://example.com as well as https://stage.example.com, will have cookies cleared. "storage" indicates that the server wishes to remove all dom storage for the origin of the response url. this includes storage mechanisms such as: localstorage (executes localstorage.clear), sessionstorage (executes ...

Feature-Policy - HTTP
ent is allowed to download and display large images. payment controls whether the current document is allowed to use the payment request api. when this policy is enabled, the paymentrequest() constructor will throw a securityerror domexception. picture-in-picture controls whether the current document is allowed to play a video in a picture-in-picture mode via the corresponding api. publickey-credentials-get controls whether the current document is allowed to use the web authentication api to retreive already stored public-key credentials, i.e. via navigator.credentials.get({publickey: ..., ...}). sync-xhr controls whether the current document is allowed to make synchronous xmlhttprequest requests. usb controls whether the current document is allowed to use the webusb api. wake-lock contro...

401 Unauthorized - HTTP
this status is sent with a www-authenticate header that contains information on how to authorize correctly. this status is similar to 403, but in this case, authentication is possible. ...

407 Proxy Authentication Required - HTTP
this status is sent with a proxy-authenticate header that contains information on how to authorize correctly. ...

Web app manifests
<link rel="manifest" href="/manifest.webmanifest"> note: the .webmanifest extension is specified in the media type registration section of the specification (the response of the manifest file should return content-type: application/manifest+json). browsers generally support manifests with other appropriate extensions like .json (content-type: application/json). note: if the manifest requires credentials to fetch - the crossorigin attribute must be set to use-credentials, even if the manifest file is in the same origin as the current page. splash screens in chrome 47 and later, a splash screen is displayed for sites launched from a homescreen. this splashscreen is auto-generated from properties in the web app manifest, specifically: name background_color the icon in the icons array that i...

Mixed content - Web security
data from the user. hence, in addition to the risks described for mixed display content above, mixed active content is vulnerable to a few other attack vectors. in the mixed active content case, a man-in-the-middle attacker can intercept the request for the http content. the attacker can also rewrite the response to include malicious javascript code. malicious active content can steal the user's credentials, acquire sensitive data about the user, or attempt to install malware on the user's system (by leveraging vulnerabilities in the browser or its plugins, for example). the risk involved with mixed content does depend on the type of website the user is visiting and how sensitive the data exposed to that site may be. the webpage may have public data visible to the world or private data visible only...

Secure contexts - Web security
t. the primary goal of secure contexts is to prevent mitm attackers from accessing powerful apis that could further compromise the victim of an attack. why should some features be restricted? some apis on the web are very powerful, giving an attacker the ability to do the following and more: invade a user's privacy. get low-level access to a user's computer. get access to data such as user credentials. when is a context considered secure? a context is considered secure when it meets certain minimum standards of authentication and confidentiality defined in the secure contexts specification. a particular document is considered to be in a secure context when it is the active document of a top-level browsing context (basically, a containing window or tab) that is a secure context. for example...