4 ms·
That can be easily fudged, can it not?
by martin 19y ago
That can be easily fudged, can it not?
- bdr 19y agoYes, but not to do the kind of attack simonw is thinking about. You can't set the header from Javascript or HTML. You can forge it from older versions of Flash, but Flash 9 has enough penetration now that it's safe.
- rms 19y agoSo what's to stop an attacker from downloading an old version of flash?
- deleted 19y ago[deleted]
- bdr 19y agoOnly browsers with an old version of Flash installed can be tricked into executing a forged cross-site request. The attacker wouldn't gain anything by installing it on their own machine.