3 ms·

You're welcome. Yes you still can make GET requests from evil.com to bank.com/transfer.php by setting the image src or script src or form submission though you

You're welcome. Yes you still can make GET requests from evil.com to bank.com/transfer.php by setting the image src or script src or form submission though you won't be able to read the response. This is probably the reason that any url that makes changes to user data like logout.php, transfer.php, etc must be a POST request (with csrf token to protect again requests created via form submissons) Also it's still possible to bypass CORS using JSONp requests or for submisson, but for that transfer.php must support jsonp too (by setting the callback method)

abstractbarista 7y ago
Wow that makes more sense too. Basically, don't implement GET in any remotely-sensitive API that actually causes changes in the remote system/service? EDIT: Why isn't there a header that web servers can give out to browsers basically saying "Don't use the cookie/session I'm giving you ever, unless you're literally on this site"? I could see this being very useful for banks or other origins where they expect no requests except from direct users.
- superasn 7y ago
  Yes also see my comment about csrf token too. If the request changes user data it must be a POST request with csrf protection. You can't make POST requests with ajax as CORS will protect you, but evil.com can create a fake form submission (with bank.com/transfer.php as the form's action) which can be a POST request. So in this case you match the csrf token which only you know and which is unique for the form/session. It's a rabbithole :)
  - greenshackle2 7y ago
    It seems you can make a POST request from javascript, as long as it doesn't have non-standard headers or content-type. Try it yourself: https://news.ycombinator.com/item?id=20406633 https://news.ycombinator.com/item?id=20406633
- yyyk 7y ago
  "Why isn't there a header that web servers can give out to browsers basically saying "Don't use the cookie/session I'm giving you ever, unless you're literally on this site"?" There is, it's relatively new though: https://blog.mozilla.org/security/2018/04/24/same-site-cookies-in-firefox-60/ https://blog.mozilla.org/security/2018/04/24/same-site-cooki...

abstractbarista 7y ago

Wow that makes more sense too. Basically, don't implement GET in any remotely-sensitive API that actually causes changes in the remote system/service? EDIT: Why isn't there a header that web servers can give out to browsers basically saying "Don't use the cookie/session I'm giving you ever, unless you're literally on this site"? I could see this being very useful for banks or other origins where they expect no requests except from direct users.

superasn 7y ago
Yes also see my comment about csrf token too. If the request changes user data it must be a POST request with csrf protection. You can't make POST requests with ajax as CORS will protect you, but evil.com can create a fake form submission (with bank.com/transfer.php as the form's action) which can be a POST request. So in this case you match the csrf token which only you know and which is unique for the form/session. It's a rabbithole :)
- greenshackle2 7y ago
  It seems you can make a POST request from javascript, as long as it doesn't have non-standard headers or content-type. Try it yourself: https://news.ycombinator.com/item?id=20406633 https://news.ycombinator.com/item?id=20406633
yyyk 7y ago
"Why isn't there a header that web servers can give out to browsers basically saying "Don't use the cookie/session I'm giving you ever, unless you're literally on this site"?" There is, it's relatively new though: https://blog.mozilla.org/security/2018/04/24/same-site-cookies-in-firefox-60/ https://blog.mozilla.org/security/2018/04/24/same-site-cooki...