[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-571641-105":53,"doc-detail-571641-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","the-great-request-robbery-an-empirical-study-of-client-side-request-hijacking","The Great Request Robbery - An Empirical Study of Client-side Request Hijacking","","Request forgery attacks have long targeted web applications, traditionally enabled by server-side confused deputy vulnerabilities. Recent client-side advancements enable subtler request forgery variants: attackers exploit client input-validation weaknesses to hijack outgoing requests. Limited evidence exists on these client-side cases—their prevalence, real-world impact, and effective countermeasures. This paper performs an empirical evaluation, systematically classifying vulnerabilities, measuring exposure across major sites, demonstrating multiple exploit outcomes, and assessing practical defenses.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/the-great-request-robbery-an-empirical-study-of-client-side-request-hijacking/571641/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/the-great-request-robbery-an-empirical-study-of-client-side-request-hijacking/571641.png","ImageObject",442,249,{"name":88,"@type":89},"BigDaveOnline","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-22","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",6,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What problem does client-side request hijacking exploit?","Question",{"text":109,"@type":110},"It exploits attacker-controllable inputs in client-side programs to create and send network requests, often due to insufficient input validation.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"How is client-side request hijacking studied in this paper?",{"text":114,"@type":110},"The paper reviews browser API capabilities, systematizes request-hijacking vulnerabilities, builds a detection tool (Sheriff), measures prevalence across top sites, and evaluates defenses.",{"name":116,"@type":107,"acceptedAnswer":117},"What impacts can attackers achieve via these vulnerabilities?",{"text":118,"@type":110},"The study demonstrates proof-of-concept exploits enabling arbitrary code execution, information leakage, open redirections, and CSRF against multiple popular sites.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},571641,1792112750,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":136,"language":137,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":138,"faqs":139,"seo_title":140,"seo_description":61,"update_tm":141,"read_time":142},962090896214,"https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d","The Great Request Robbery: An Empirical Study of Client-side Request Hijacking  \nVulnerabilities on the Web  \nSoheil Khodayari†, Thomas Barber* , and Giancarlo Pellegrino†  \n† CISPA Helmholtz Center for Information Security, * SAP Security Research  \nfsoheil.khodayari, [pellegrino](pellegrinog@cispa.de)[g](pellegrinog@cispa.de)[@cispa.de](pellegrinog@cispa.de), [thomas.barber@sap.com](thomas.barber@sap.com)  \nAbstract—Request forgery attacks are among the oldest threats to Web applications, traditionally caused by server-side confused deputy vulnerabilities. However, recent advancements in client-side technologies have introduced more subtle variants of request forgery, where attackers exploit input validation flawsin client-side programs to hijack outgoing requests. We have little-to-no information about these client-side variants, their  \nprevalence, impact, and countermeasures, and in this paper we undertake one of the first evaluations of the state of client-side request hijacking on the Web platform.  \nStarting with a comprehensive review of browser API capabilities and Web specifications, we systematize request hijacking vulnerabilities and the resulting attacks, identifying 10 distinct vulnerability variants, including seven new ones. Then, we use our systematization to design and implement Sheriff, a static-dynamic tool that detects vulnerable data flows from attacker-controllable inputs to request-sending instructions. We instantiate Sheriff on the top of the Tranco top 10K sites, performing, to our knowledge, the first investigation into the prevalence of request hijacking flaws in the wild. Our study uncovers that request hijacking vulnerabilities are ubiquitous, affecting 9.6% of the top 10K sites. We demonstrate the impact of these vulnerabilities by constructing 67 proof-of-concept exploits across 49 sites, making it possible to mount arbitrary code execution, information leakage, open redirections and CSRF also against popular websites like Microsoft Azure, Starz, Reddit, and Indeed. Finally, we review and evaluate the adoption and efficacy of existing countermeasures against client-side request hijacking attacks, including browser-based solutions like CSP, COOP and COEP, and input validation.  \nIndex Terms—CSRF, Request Hijacking, Prevalence, Defenses  \n1. Introduction  \nRequest forgery attacks have been one of the most critical threats to web applications since the early days of the Web, where attackers trick victims' browsers into making authenticated, security-sensitive [HTTP requests](HTTP requests) [1– 5] . The fundamental vulnerability enabling these attacks is the inability of the server-side component to distinguish unintentional from intentional requests (i.e., the confused deputy flaw [6, 7]), allowing maliciously-forged requests  \nto cause a persistent state change of the web application, such as resetting passwords [8, 9] or deleting data from databases [10, 11] . The recent rapid evolution of client-side technologies has introduced more subtle variants of request forgery vulnerabilities where attackers no longer rely on the confused deputy flaw but instead exploit insufficient input validation vulnerabilities in the client-side JavaScript program to hijack outgoing requests. The research community has only recently started exploring these vulnerabilities, mainly focusing on client-side Cross-Site Request Forgery (CSRF) [12–14] and a corresponding detection and analysis technique [12] . Unfortunately, client-side CSRF is only one instance of the larger issue of request hijacking in web applications, as other types of outgoing [HTTP requests](HTTP requests) exist within JavaScript programs that attackers can hijack, which, to date, remain largely unexplored.  \nClient-side request hijacking vulnerabilities occur when a JavaScript program uses attacker-controllable inputs, such as URL parameters, to create and send network requests. A closer look at prior work reveals that they primarily focus on asynchronous re","cbCaib1YNOfP1v57","https://ap.wps.com/l/cbCaib1YNOfP1v57","pdf",922933,19,"English","# Abstract\n# 1. Introduction\n## Background on request forgery and confused deputy\n## Emergence of client-side request hijacking\n## Related work and coverage gaps\n## Scope and contributions of the study","[{\"question\":\"What problem does client-side request hijacking exploit?\",\"answer\":\"It exploits attacker-controllable inputs in client-side programs to create and send network requests, often due to insufficient input validation.\"},{\"question\":\"How is client-side request hijacking studied in this paper?\",\"answer\":\"The paper reviews browser API capabilities, systematizes request-hijacking vulnerabilities, builds a detection tool (Sheriff), measures prevalence across top sites, and evaluates defenses.\"},{\"question\":\"What impacts can attackers achieve via these vulnerabilities?\",\"answer\":\"The study demonstrates proof-of-concept exploits enabling arbitrary code execution, information leakage, open redirections, and CSRF against multiple popular sites.\"}]","The Great Request Robbery - An Empirical Study of Client-side Request Hijacking | PDF",1791922872,7]