3 ms·
I thought that an attacker's JS code can't read the response from a GET request in a CSRF attack. Or are you saying it's possible for the attacker to read the H
by bdupharm 10y ago
I thought that an attacker's JS code can't read the response from a GET request in a CSRF attack. Or are you saying it's possible for the attacker to read the HTTP status code of the response?
- airza 10y agoI think you're correct here. Also, like POST-based CSRF, get-based CSRF is also a solved problem (issue a param in the URL)