After more testing, I was incorrect about the voting URLs being capability URLs, because you need to be logged-in to vote. True capability URLs don't this, beca

After more testing, I was incorrect about the voting URLs being capability URLs, because you need to be logged-in to vote. True capability URLs don't this, because merely having the URL entitles you to all the access. This makes the 'auth' parameter in the voting link a CSRF token [1]. A different site wouldn't be aware of the token, but might be aware of the rest of the URL (Post ID, vote direction). By requiring a large, unguessable token to also be provided along with a vote, a third-party site cannot naively issue CSRF to vote on a particular story on a user's behalf. [1] https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Synchronizer_.28CSRF.29_Tokens https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(...