Q and A on cross site request forgeries and breaking into sessions. It's one of the attacks that XSS enables and the attack of the future. For Session, fixations, hijacking, lockout, replay, session riding etc....
There is problem with ajax, when is 'ajax' XMLHttpRequest get request made to server which is gzip enabled.
Server response gzip-inflated data. But 'XMLHttpRequest' doesn't decompress it
at all and silent error happen which responds nothing and status bar in fx just stays loading but doing nothing. But with 'mitm' tool between serv. and browser there is 'gzip inflated' data junk from server sent to browser and then nothing. [and js code to be executed after our request isnt executed just "stays loading" bar like i said]
So is there some header trick which says to the server that we dont accept gzip responses, to get normal response.
Or if anybody know for "ajax framework" which supports gzip, for which I doubt.
Any help?? [I dont expect answer from somebody who would write like disable gzip on server]
I'm lost. I googled but find nothing. I thought this is known and expected scenario, must be solution, but is there:)?
Xinstict
Edited 3 time(s). Last edit at 10/21/2007 05:27PM by Xinstict.
