3 ms·
The CSRF token should be tied to the user session, so you'd need to perform session fixation for that to work.
by r1ch 11y ago
The CSRF token should be tied to the user session, so you'd need to perform session fixation for that to work.
- kogir 11y agoThat works if you have sessions. HN doesn't.
- ubernostrum 11y agoTying to the session is a common practice but not necessary. You can do non-session-tied CSRF tokens so long as you don't expose your cookie.