4 ms·
Slightly Off-Topic: How safe are those application controlling URLs? Can one do a CRSF like <img src="camplus://enablevolumesnap" /> ?
by aw3c2 16y ago
Slightly Off-Topic: How safe are those application controlling URLs? Can one do a CRSF like <img src="camplus://enablevolumesnap" /> ?
- bradleyland 16y agoI don't know much about them specifically, but if they're anything like all the common schemes (http, ftp, ldap, etc), your application would be responsible for implementing a security policy. For example, there is nothing about HTTP that implicitly prevents CRSF. However, web servers that speak HTTP pass information about the requester that can be used to prevent CRSF at the application layer.
- cmelbye 16y agoIt's not an HTTP server, so that example wouldn't work. The URL needs to be visited (with an anchor or just by typing into the Safari address bar), and Safari will close and open the application associated with the URL scheme.