Collected research
Detecting States of Authentication With Protected Images
Detecting States of Authentication With Protected Images ha.ckers.org web application security lab
An IMG tag pointed at a file inside a members-only directory fires onerror when the visitor is not authenticated, so any page can detect a user's login state on a third-party site. A changed image size after login works the same way. Grossman and the author could not extend it beyond protected images and scripts.
Record
- Document
- Detecting States of Authentication With Protected Images ha.ckers.org web application security lab
- Published by
- ha.ckers.org
- Topic
- Identity
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of ha.ckers.org, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .