[orion-dev] Protection against Java Script Hijacking

["Schmalz, Matthias" <matthias.schmalz@xxxxxxx>]

Hi All,

 

currently we are doing some security considerations for the usage of Orion.

One topic, that came up here, is the protection against _javascript_ hijacking (see http://capec.mitre.org/data/definitions/111.html or http://www.net-security.org/dl/articles/_javascript__Hijacking.pdf).

Have there already been any considerations about the relevance of this attack for Orion? Are there any plans to implement a protection?

An example for an attack target could be the user preference store which contains the user’s e-mail address, full name and login user.

 

Best regards

Matthias Schmalz