3 ms·
I don't think it will help. Sites that care about CSRF are already implementing protection (via CSRF tokens) and those who don't care won't use this feature. T
by codedokode 11y ago
I don't think it will help. Sites that care about CSRF are already implementing protection (via CSRF tokens) and those who don't care won't use this feature.
The main problem is that browsers allow POSTing data cross-site by default instead of blocking such requests unless it is allowed explicitly.
- ec109685 11y agoThis proposal will protect you from a bug where csrf isn't properly protected. If you know that there aren't any cases where cross site POSTing is allowed, you can block them with this proposal.