2 ms·
> First, use an XSRF token as discussed earlier to make sure that JSON results containing confidential data are only returned to your own pages. Is this necess
by jtchang 9y ago
> First, use an XSRF token as discussed earlier to make sure that JSON results containing confidential data are only returned to your own pages.
Is this necessary for GET requests that return JSON? You need to include a XSRF token in the request headers?
- codedokode 9y agoIdeally browsers should block cross-domain requests by default (so no XSRF is possible), but sadly this would break compatibility with older sites. Maybe we should make new HTTP methods (like SAFEPOST) with builtin XSRF protection and switch new apps to them?