Collected research

Cross-Site Identification (XSid)

Names Cross-Site Identification (CSID/XSid): a social network is made an involuntary identifying service. An image link on any third-party site silently drives the logged-in victim's browser to the attacker's SN application, which returns the victim's public name and photo out of context. Demonstrated on Facebook, Bebo and Orkut, including OpenSocial signed requests leaking a stable viewer id.

Record

Published by

blog.quaji.com

Topic

Other

In the archive

• Collected in the 2009 research round

Related sources

• Facebook CSRF Attack: Full Disclosure

Tags

• info-leak
• csrf
• cookie
• iframe
• case-study
• deanonymization
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of blog.quaji.com, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.