View source for WYCIWYG

{{ref improve|date=September 2012}}
'''What''' '''You''' '''Cache''' '''Is''' '''What''' '''You''' '''Get''' ('''WYCIWYG''') is a [[Uniform Resource Identifier#Definition|Uniform Resource Identifier (URI) scheme]] commonly displayed in the address bar of [[Gecko (layout engine)|Gecko]]-based [[Web browser]]s like [[Mozilla Firefox]] as {{mono|wyciwyg://}} when the [[Web browser]] is retrieving [[Web cache|cached]] information. WYCIWYG is a play on the related acronym [[WYSIWYG]] (What You See Is What You Get).

==Usage==

Mozilla Firefox implements a registered, strictly internal {{mono|wyciwyg}} URI scheme to sort and later reference locally cached pages that were generated or modified by a script on the client side (a common practice for [[Web 2.0]] sites).

==Security issues==

In 2007 [[Michał Zalewski]] reported that it was possible to bypass the same-origin checks and read from cached (wyciwyg) documents. It was possible at that time to access {{mono|wyciwyg://}} documents without proper same domain policy checks. This could have enabled an attacker to steal sensitive data, perform [[cache poisoning]] and execute their own code or display own content with URL bar and [[SSL certificate]] data of the original page ([[URL spoofing]]).<ref>[https://web.archive.org/web/20070907160824/http://lcamtuf.coredump.cx/ffcache/ Firefox wyciwyg:// cache vulnerability demo – Michal Zalewski]</ref> This was fixed in [[Firefox]] 2.0.0.5 and [[SeaMonkey]] 1.1.3.<ref>[https://www.mozilla.org/security/announce/2007/mfsa2007-24.html Mozilla Foundation Security Advisory 2007-24: Unauthorized access to wyciwyg:// documents]</ref>

==References==

<references/>

==External links==
*{{wti|WYCIWYG}}

{{URI scheme}}

[[Category:User interfaces]]
[[Category:Acronyms]]
[[Category:Computing acronyms]]
[[Category:URI schemes]]