3 ms·
Yes also see my comment about csrf token too. If the request changes user data it must be a POST request with csrf protection. You can't make POST requests wit
by superasn 7y ago
Yes also see my comment about csrf token too. If the request changes user data it must be a POST request with csrf protection.
You can't make POST requests with ajax as CORS will protect you, but evil.com can create a fake form submission (with bank.com/transfer.php as the form's action) which can be a POST request. So in this case you match the csrf token which only you know and which is unique for the form/session.
It's a rabbithole :)
- greenshackle2 7y agoIt seems you can make a POST request from javascript, as long as it doesn't have non-standard headers or content-type. Try it yourself: https://news.ycombinator.com/item?id=20406633 https://news.ycombinator.com/item?id=20406633