4 ms·
> Don't let HTTP GET requests modify state, ever. It's very difficult to prevent CSRF via HTTP GET. Isn’t it exactly as difficult as any other method? > Sessi
by minitech 10y ago
> Don't let HTTP GET requests modify state, ever. It's very difficult to prevent CSRF via HTTP GET.
Isn’t it exactly as difficult as any other method?
> Session keys are password-equivalents. Hash them with bcrypt or something before you store them.
bcrypt is overkill, especially for something that has to be checked every request; just use any SHA-2 (non-iterated). A session key should be long enough by far to resist brute force.