4 ms·
The implications depend on your app. If the user doesn't notice being logged into a new account, they may go on to create data in the attacker's account that th
by etjossem 11y ago
The implications depend on your app. If the user doesn't notice being logged into a new account, they may go on to create data in the attacker's account that they expect to be private (e.g. YouTube watch history).
On e-commerce sites, they might add a credit card - thereby allowing the attacker to use it.
Fortunately, HN doesn't have these risks, but it's a good illustration of how CSRF works in the real world.
- lucb1e 11y agoGood points indeed. I never thought of adding anti-CSRF measures to login forms, only while logged in, so I'll start doing that :)
- r1ch 11y agoAnother good reason for login CSRF tokens is to prevent a malicious page from submitting lots of invalid logins and getting an account / IP locked or rate limited.
- ghayes 11y agoPlus if you made the account name "new" or "top posts" or something, it could take weeks for me to notice that it didn't say my username at the top right.