TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Stealing Bearer Tokens with an Angular Expression Injection

10 pointsby ryhansonover 9 years ago

4 comments

mikelarnedover 9 years ago
It looks like this is only possible when we are mixing server side / client side templates? Enter an expression into input, a user hard refreshes and the expression is rendered into our angular template. Are there any good approaches to always scrubbing expression input on the server side (or just avoid the client side / server side template mix?)
评论 #10622377 未加载
rpkelleyover 9 years ago
I bet there are a lot more production angular apps out there than people think that have this vulnerability right now.
评论 #10622331 未加载
bossmojomanover 9 years ago
Crazy, now to go double check all my angular code
lorenmorrisover 9 years ago
This is a legitimate comment.