5 ms·
How's the resource containing the nonce any more secure than just a plain "delete-account" endpoint? Thinking about it, you could probably use CORS and some me
by t0astbread 7y ago
How's the resource containing the nonce any more secure than just a plain "delete-account" endpoint?
Thinking about it, you could probably use CORS and some methods like X-Frame-Options to protect your nonce. But then you could just use that on the whole deletion page and avoid the nonce, I guess?
- vortico 7y agoThe nonce would only be available if you scrape the page while logged in and extract the logout URL, which is impossible with iframes.
- t0astbread 7y agoCould you not still scrape the HTTP response for the page containing the nonce?
- vortico 7y agoNot with a browser, no.