4 ms·

Wow that makes more sense too. Basically, don't implement GET in any remotely-sensitive API that actually causes changes in the remote system/service? EDIT: Wh

Wow that makes more sense too. Basically, don't implement GET in any remotely-sensitive API that actually causes changes in the remote system/service? EDIT: Why isn't there a header that web servers can give out to browsers basically saying "Don't use the cookie/session I'm giving you ever, unless you're literally on this site"? I could see this being very useful for banks or other origins where they expect no requests except from direct users.

superasn 7y ago
Yes also see my comment about csrf token too. If the request changes user data it must be a POST request with csrf protection. You can't make POST requests with ajax as CORS will protect you, but evil.com can create a fake form submission (with bank.com/transfer.php as the form's action) which can be a POST request. So in this case you match the csrf token which only you know and which is unique for the form/session. It's a rabbithole :)
- greenshackle2 7y ago
  It seems you can make a POST request from javascript, as long as it doesn't have non-standard headers or content-type. Try it yourself: https://news.ycombinator.com/item?id=20406633 https://news.ycombinator.com/item?id=20406633
yyyk 7y ago
"Why isn't there a header that web servers can give out to browsers basically saying "Don't use the cookie/session I'm giving you ever, unless you're literally on this site"?" There is, it's relatively new though: https://blog.mozilla.org/security/2018/04/24/same-site-cookies-in-firefox-60/ https://blog.mozilla.org/security/2018/04/24/same-site-cooki...