Databases
StackOverflow2013
Postsdbo
POWhy do FireFox and certain other browsers alter the URL in the address bar when the server responds
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POWhy do FireFox and certain other browsers alter the URL in the address bar when the server responds
    primarykey
    data
    text
    <p>I'm having difficulty meeting PCI-DSS compliance this quarter because of the following problem.</p> <p>When you type the following into a browser...</p> <pre><code>http://www.mygarble.com/main/Community/Chat?command=CHAT_MESSAGE&amp;displayname=%22%3E%3Cscript%3Ealert%28123%29%3C%2Fscript%3E%22 </code></pre> <p>...it responds and, as a consequence, for some reason that I cannot ascertain, the URL in the browswer address bar is changed to the following:</p> <pre><code>http://www.mygarble.com/main/Community/Chat?command=CHAT_MESSAGE&amp;displayname="&gt;&lt;script&gt;alert(123)&lt;%2Fscript&gt;" </code></pre> <p>You can see that some of the escaped characters in the original URL have been replaced by unescaped ones.</p> <p>The reason I gave for this is that FireFox automatically reformats the URL in the address bar when the server responds, no matter how it responds, in order to make it more readable. I told them there was nothing I could do about it. However, in fairness, they countered that if you try the following URL...</p> <pre><code>http://www.google.com/%22%%203E%3Cscript%3Ealert%28123%29%3C%2Fscript%3%20E%22 </code></pre> <p>...when the Google servers respond, the browser does not change the URL and it remains the same:</p> <pre><code>http://www.google.com/%22%%203E%3Cscript%3Ealert%28123%29%3C%2Fscript%3%20E%22 </code></pre> <p>And they have a point.</p> <p>So what on earth is going on? I've narrowed down the problem and if I do no more than request an empty text file, but append some nonsense query after it...</p> <pre><code>http://localhost/http.mygarble.com/hello.txt?displayname=%22%3E%3Cscript%3Ealert%28123%29%3C%2Fscript%3E%22 </code></pre> <p>...lo and behold it gets rewritten when my local server responds:</p> <p><a href="http://localhost/http.mygarble.com/hello.txt?displayname=%22%3E%3Cscript%3Ealert%28123%29%3C%2Fscript%3E%22" rel="nofollow">http://localhost/http.mygarble.com/hello.txt?displayname=%22%3E%3Cscript%3Ealert%28123%29%3C%2Fscript%3E%22</a></p> <p>I've run this through Fiddler and can see nothing untoward, and I've turned off the rewrite engine. I'm running Apache.</p> <p>To add to the confusion, different browsers respond differently. Typing...</p> <pre><code>http://localhost/http.mygarble.com/hello.txt?displayname=%22%3E%3Cscript%3Ealert%28123%29%3C%2Fscript%3E%22 </code></pre> <p>...into Chrome yields:</p> <p><a href="http://localhost/http.mygarble.com/hello.txt?displayname=%22%3E%3Cscript%3Ealert%28123%29%3C%2Fscript%3E%22" rel="nofollow">http://localhost/http.mygarble.com/hello.txt?displayname=%22%3E%3Cscript%3Ealert%28123%29%3C%2Fscript%3E%22</a></p> <p>Into IE, the URL stays exactly the same. In Opera, the query string is dropped unless you click on the address bar, lending credence to my belief that browsers automatically change URLs in address bars on response in order to make them more readable. Safari, like IE, leaves the URL alone.</p> <p>I'm going to check Google's response now for clues. Is there some HTTP directive that instructs the browser not to meddle with the URL on response.</p> <p>Any help very gratefully appreciated!</p> <p>Kind regards,</p> <p>James</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. This table or related slice is empty.
    1. USJames Smith
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POWhy do FireFox and certain other browsers alter the URL in the address bar when the server responds
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POWhy do FireFox and certain other browsers alter the URL in the address bar when the server responds
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POWhy do FireFox and certain other browsers alter the URL in the address bar when the server responds
      1. This table or related slice is empty.
      1. VTUpMod
    1. COWhat has this got to do with pci-dss? I don't get it.
      singulars
      1. POWhy do FireFox and certain other browsers alter the URL in the address bar when the server responds
      1. USOded
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload