Collected research

HTML Over the Wire

Ryan · ~ryan · 30 July 2023

HTML-over-the-wire frameworks such as Hotwire Turbo, HTMX and Unpoly intercept link clicks and expose fetch features through plain HTML attributes, so an injected link can issue a POST and carry attacker-chosen headers.

Record

Researcher

Ryan

Published by

~ryan

Date

30 July 2023

Topic

Other

In the archive

• Collected in the 2023 research round

Tags

• csrf
• info-leak
• injection
• dom
• javascript
• rails
• attack-chain
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Ryan, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.