Is my surfing behavior vulnerable to XSS attacks?

[izzysoup]

Hello, I would like some insights on XSS / security concerns while having the admin section of your site open and viewing other 'trusted' websites at the same time. I understand that as a rule, one should never have an active admin login session while viewing other websites in a different tab.

That being said, I have never surfed any other website while being logged in to the admin and used a different window of the same browser (Chrome), but there are occasions where I have had to look at other websites (competitors and suppliers websites) while being logged in. Is this safe if I am using one browser (Chrome) to have an active admin login session and another browser (Firefox or IE) to be logged into a suppliers website?

Or am I still "handling raw chicken and licking your fingers" (http://www.zen-cart.com/wiki/index.p...ecommendations)

Many thanks, Izzy.

[DrByte]

It would be foolish of me to say "don't worry, it'll be fine", because I have no idea what your website surfing behaviors are like, nor how you've changed or added to your site's ZC core code in ways that might break the built-in security protections. So I have to give you the safe answer:

You should follow the "general rule" to "not surf other sites with an active Admin session open in the same browser". That's just plain safe practice.

That said, Zen Cart goes to great lengths to prevent typical XSS and CSRF risks, especially in the latest version (v1.5.3 is even better than 1.5.1 was in this area).

But, no matter how smart ZC is, if you're surfing sites that could be prone to launching XSS attacks against you, then you owe it to yourself to make some changes and practice safe computing behaviors.

[izzysoup]

hello. I was hoping this would be safe. LOL I guess I best get down to PC World and pick up a 2nd laptop. Planning to update to 1.5.3 in the next few months :)