3 ms·
Well, I would say its not 'just as dangerous' as a man in the middle attack is harder to set up. Good point though. Maybe this could be solved by including a u
by al_james 16y ago
Well, I would say its not 'just as dangerous' as a man in the middle attack is harder to set up.
Good point though. Maybe this could be solved by including a unique access code with the form that is a hashed value of the user'id and the url that you are submitting to (with salting to make this unguessable). Simply check this value upon submission to make sure it matches the URL seen by the controller. That would prevent anyone rewriting a form to submit to a new endpoint.
- iampims 16y agoIsn't it why we need to implement xsrf protection on every form?
- mike-cardwell 16y agoCSRF protection should be implemented even if your entire site is protected by SSL. Also, I didn't say "just as dangerous", I said "just dangerous"
- al_james 16y agoSorry for misquoting you. However, with proper CSRF protection your man in the middle argument is not the case is it?