4 ms·
To be perfectly clear, Sam is not wrong. Flash and Java both let you issue requests with that header. However, if you try and make a cross-origin request, they'
by nbpoole 16y ago
To be perfectly clear, Sam is not wrong. Flash and Java both let you issue requests with that header. However, if you try and make a cross-origin request, they'll both throw exceptions unless you have permission (in the form of a crossdomain.xml file). I assume that's where the redirects come into play, although I can't imagine how you redirect someone's POST request to a different domain.
- tptacek 16y agoI'm just messing with you both. Resetting sessions on CSRF failures is going to suck for us.
- bonzoesc 16y agoIs there any reason to reset the session on a CSRF failure vs. just failing the request? Seems like you could have fun DOSing people from their sessions on other sites with that default behavior.
- nbpoole 16y agoThat's right. Of course, without knowing more details about the vulnerability, it's hard to say whether there's a benefit to ending the session.
- emerose 16y agoI don't have any inside information on this, but my guess is that this is going to come down to confusion about 302/303/307 redirects. In theory, clients receiving a 302 in response to a POST are supposed to re-send the POST wherever the redirect leads; in practice, clients do all kinds of different things. This feels like just the kind of weird edge case that defeats fragile security mechanisms like crossdomain.xml.