3 ms·

Isn't that vulnerable to CSRF? What if a page linked on the front of HN makes a request collapsing every single comment?

• slg 7y ago
  One of the top posts in the history of HN was a link that upvoted itself due to this issue.
• thepete2 7y ago
  Yes, but you need a token to log out. For collapsing comments it should work though
  • thepete2 7y ago
    correction: same origin policy, so it doesn't work
    • lol768 7y ago
      SOP isn't relevant here - it relates generally to _reading_ content from another origin. What is relevant here is whether the cookies are SameSite and/or whether a token is required.