Hacker Blogs
Work in progress: 82,651 of 181,233 sites checked so far, more every week · updated 2 Nov 2026Missing a blog? Tell us

Top all-time · #2838

W

Web Security Blog

Company blog · blog.portswigger.netsecurity

Web Security Blog is the company blog at blog.portswigger.net, writing about security. Since 2010, 26 different Hacker News readers have linked it 35 times, most often “Web Storage: the lesser evil for session tokens”. No feed was found, so read it on the site itself.

No feed foundVisit the blog
35mentions?
26HN people?
2010–2018first – last linked?
Links on Hacker News per year · peak 16 in 2016

Articles and product insights from the PortSwigger team. Keep up to date with Burp Suite and the world of web security by visiting our blog.

Most-linked posts?

  1. Web Storage: the lesser evil for session tokens
    4 people · 5 mentions · first linked 2016-05-31
  2. Detecting and exploiting path-relative stylesheet import vulnerabilities
    3 people · 3 mentions · first linked 2015-02-17
  3. XSS Without HTML: Client-Side Template Injection with AngularJS
    2 people · 2 mentions · first linked 2016-01-27
  4. Backslash Powered Scanning: Hunting Unknown Vulnerability Classes
    2 people · 2 mentions · first linked 2016-11-04
  5. Exploiting CORS Misconfigurations for Bitcoins and Bounties
    2 people · 2 mentions · first linked 2016-10-18
  6. JSON hijacking for the modern web
    2 people · 2 mentions · first linked 2016-11-26
  7. Executing non-alphanumeric JavaScript without parentheses
    2 people · 2 mentions · first linked 2016-07-15

What Hacker News says?

  1. JadeNB · 2016-09-01
    See also http://blog.portswigger.net/2016/07/executing-non-alphanumer... for executable JavaScript without parentheses .

    Comment linking /2016/07/executing-non-alphanumeric-javascript.html

    on “Code that is valid in both PHP and Java, and produces the same output in both”
  2. skybrian · 2017-07-29

    Submitted Targeting HTTP's Hidden Attack-Surface as a story · 207 points

    HN discussion
  3. deathanatos · 2017-03-14
    The downside being that the browser will attach it to every request; if you use cookies, you MUST be aware of this, or you are (IMO) pretty much guaranteed to write a CSRF vuln. (I'm much more in the localStorage + Authorization header for this reason. I recommend [1] for reading. If malicious JS is running, cookies won't save you, since the malicious JS is capable of simply making the request itself, to which the c…

    Comment linking /2016/05/web-storage-lesser-evil-for-session.html

    on “JSON Web Tokens should be avoided”
  4. kkl · 2016-05-31

    Submitted Web Storage: the lesser evil for session tokens as a story · 195 points

    HN discussion
  5. areed · 2016-06-19
    Because you can set Secure and HttpOnly flags on cookies? This merely brings them up to the same level of security you get with Local Storage. http://blog.portswigger.net/2016/05/web-storage-lesser-evil-...

    Comment linking /2016/05/web-storage-lesser-evil-for-session.html

    on “JSON Web Tokens vs. Sessions”
  6. kkl · 2016-07-15

    Submitted Executing non-alphanumeric JavaScript without parentheses as a story · 123 points

    HN discussion
  7. livingontheedge · 2013-03-18
    <!--Removed after seeing response about automating tool--> You can script the scanner to auto-decode B64 cookie once you found them: http://blog.portswigger.net/2012/12/sample-burp-suite-extens... It all boils down to: how can you be so sure if your tool/process is finding most vulnerabilities than others, and can you prove it? If I were your client, I would be very worried by now.

    Comment linking /2012/12/sample-burp-suite-extension-custom-scan.html

    on “So You Want To Be A Breaker, Part 1: Web Security”
  8. wglb · 2011-05-15

    Submitted Web App Hacker's Handbook 2nd Edition - Preview as a story · 70 points

    HN discussion
  9. kkl · 2016-06-14
    If you don't believe `tptacek maybe you will believe James Kettle: http://blog.portswigger.net/2016/05/web-storage-lesser-evil-...

    Comment linking /2016/05/web-storage-lesser-evil-for-session.html

    on “Don't use JSON web tokens for sessions”
  10. inian · 2016-12-01

    Submitted Bypassing CSP using polyglot JPEGs as a story · 43 points

    HN discussion
  11. TACIXAT · 2015-11-02
    Might be useful in conjunction with a path-relative stylesheet include. http://blog.portswigger.net/2015/02/prssi.html

    Comment linking /2015/02/prssi.html

    on “CSS Based Attack fontface”
  12. j_s · 2017-07-27

    Submitted Cracking the Lens: Targeting HTTP's Hidden Attack-Surface as a story · 36 points

    HN discussion
  13. albinowax_ · 2016-07-15
    Pretty much - the first paragraph links to an example of this technique being used to exploit Uber's developer documentation - http://blog.portswigger.net/2016/04/adapting-angularjs-paylo...

    Comment linking /2016/04/adapting-angularjs-payloads-to-exploit.html

    on “Executing non-alphanumeric JavaScript without parentheses”
  14. restlessmedia · 2015-02-17

    Submitted Detecting and exploiting path-relative stylesheet import vulnerabilities as a story · 18 points

    HN discussion
  15. dagobah · 2017-11-13
    Yea, but doing it that way requires same origin policy not to be weakened like from CORS being misconfigured. http://blog.portswigger.net/2016/10/exploiting-cors-misconfi... talks about exploits from this. But what I am wondering is if using "Access-Control-Allow-Origin: evil-site.example.com or *" can be used to exploit the cookie-to-header technique with a token for every request (GETS included), no form GETS (so…

    Comment linking /2016/10/exploiting-cors-misconfigurations-for.html

    on “Can “Cookie to header token” CSRF prevention be beaten with permissive CORS?”
  16. dsr12 · 2016-11-26

    Submitted JSON hijacking for the modern web as a story · 10 points

    HN discussion
  17. bvttf · 2018-01-23
    going to go with Burp's devs on this one http://blog.portswigger.net/2016/05/web-storage-lesser-evil-...

    Comment linking /2016/05/web-storage-lesser-evil-for-session.html

    on “How EU Cookie Law Myths Affect Web Security”
  18. cujanovic · 2016-11-07

    Submitted Backslash Powered Scanning: Hunting Unknown Vulnerability Classes as a story · 4 points

    HN discussion
  19. dsr12 · 2017-10-06

    Submitted When Security Features Collide as a story · 3 points

    HN discussion
  20. albinowax_ · 2016-11-29

    Submitted JSON hijacking for the modern web as a story · 3 points

    HN discussion
  21. gregmolnar · 2015-08-09

    Submitted PortSwigger Web Security Blog: Server-Side Template Injection as a story · 3 points

    HN discussion
  22. mbrubeck · 2015-02-25

    Submitted Detecting and exploiting path-relative stylesheet import vulnerabilities as a story · 3 points

    HN discussion
  23. kobayashi · 2017-08-21

    Submitted How I Accidentally Framed Myself for a Hacking Frenzy as a story · 2 points

    HN discussion
  24. rshetty10 · 2016-04-15

    Submitted Microsoft Edge XSS Filter Bypass as a story · 2 points

    HN discussion
  25. potench · 2016-01-25

    Submitted Introducing Burp Collaborator: Web Security Testing as a story · 2 points

    HN discussion
  26. matthewbauer · 2015-08-17

    Submitted Abusing Chrome's XSS auditor to steal tokens as a story · 2 points

    HN discussion
  27. wglb · 2011-06-04

    Submitted Burp Suite Free Edition v1.4 released as a story · 2 points

    HN discussion
  28. danso · 2016-11-04

    Submitted Backslash Powered Scanning: Hunting Unknown Vulnerability Classes as a story · 1 points

    HN discussion
  29. albinowax_ · 2016-10-18

    Submitted Exploiting CORS Misconfigurations for Bitcoins and Bounties as a story · 1 points

    HN discussion
  30. restlessmedia · 2016-01-28

    Submitted XSS Without HTML: Client-Side Template Injection with AngularJS as a story · 1 points

    HN discussion

Search all of HN for blog.portswigger.net

Linked by the same people?