3 ms·

So... Break the web for anyone not on the latest version of Chrome?

• jasonhansel 7y ago
  No, just give devs the ability to easily catch the error & use an alternative, secure solution.
  • lighthazard 7y ago
    "easily"
  • javagram 7y ago
    If there were an easy, alternative secure solution then developers would already be using it. Implementing common anti-XSRF mechanisms like a session token in a form field or extra http header requires modifying every place your app communicates with the server. It’s anything but easy which is why so many apps/websites not built with XSRF in mind still have vulnerabilities.