3 ms·
wget, curl, whatever. If I'm the attacker, I ask for a new one from my server each time and put the result in the form I serve your browser.
by kogir 11y ago
wget, curl, whatever. If I'm the attacker, I ask for a new one from my server each time and put the result in the form I serve your browser.
- r1ch 11y agoThe CSRF token should be tied to the user session, so you'd need to perform session fixation for that to work.
- kogir 11y agoThat works if you have sessions. HN doesn't.
- ubernostrum 11y agoTying to the session is a common practice but not necessary. You can do non-session-tied CSRF tokens so long as you don't expose your cookie.