Later archive addition

CSP fingerprinting with same-origin redirects

やっていく気持ち and @lmt_swallow

The article shows that Firefox's handling of same-origin redirects under Content Security Policy leaks whether a target URL redirects. By embedding carefully chosen resources and observing policy outcomes, an attacker can fingerprint authenticated application state and other redirect-dependent information across origins.

Record

Researcher

やっていく気持ち and @lmt_swallow

In the archive

• Added to the 2018 archive after the original list was published

Tags

• csp
• redirect
• xsleak
• firefox
• side-channel
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of やっていく気持ち and @lmt_swallow, first published at the original source. Preserved copies are kept so the citation survives its host.