Collected research

Cross-Origin Web Attacks via HTTP/2 Server Push and Signed HTTP Exchange

Pinji Chen, Jianjun Chen, Mingming Zhang, Qi Wang, Yiming Zhang, Mingwei Xu and Haixin Duan · NDSS Symposium

HTTP/2 server push and Signed HTTP Exchange authorise content by the certificate's subject alternative names rather than by the URI origin, so where a certificate is shared an off-path attacker can push or sign responses for any domain it covers. The result is cross-origin XSS, cookie manipulation and malicious downloads.

Record

Researcher

Pinji Chen, Jianjun Chen, Mingming Zhang, Qi Wang, Yiming Zhang, Mingwei Xu and Haixin Duan

Published by

NDSS Symposium

Topic

HTTP

In the archive

• Collected in the 2025 research round

Related sources

• Black Hat USA 2025 | Cross-Origin Web Attacks via HTTP/2 Server Push and Signed HTTP Exchange
• NDSS 2025 - Cross-Origin Web Attacks via HTTP/2 Server Push and Signed HTTP Exchange
• NDSS 2025 - Cross-Origin Web Attacks via HTTP/2 Server Push and Signed HTTP Exchange

Tags

• http2
• sop-bypass
• same-origin-policy
• tls
• xss
• cookie
• cache
• measurement-study
• owasp-a01-2021
• owasp-a02-2021
• owasp-a03-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Pinji Chen, Jianjun Chen, Mingming Zhang, Qi Wang, Yiming Zhang, Mingwei Xu and Haixin Duan, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.