5 ms·

Wouldn't this still allow logging in without consent if they aren't logged in?

• Osiris 11y ago
  I have implemented CSRF for the public API I work on and all PUT/POST requests require the CSRF token, not GET requests. In this case, the login form uses a POST request and thus must require a CSRF token to avoid an attack on users that aren't logged in.
  • kogir 11y ago
    What stops an attacker from requesting the CSRF token?
    • r1ch 11y ago
      Same-origin policy.
      • kogir 11y ago
        That only applies to browsers. I can request it from my server just fine. See https://news.ycombinator.com/item?id=11178922 https://news.ycombinator.com/item?id=11178922
• dang 11y ago
  It does. We haven't rolled out the fix that Nick described (https://news.ycombinator.com/item?id=11178922 https://news.ycombinator.com/item?id=11178922) because it will probably break a bunch of the third party apps and scrapers that give people alternative interfaces to HN. Those have value and I'd rather not make their lives more difficult unless/until it's necessary.
  • qjighap 11y ago
    Finally, some clarification on which hacker news it is. I care less about the hacker news with the "the"