3 ms·
What if that forged request was to a "create new account" URL, for example? Or to delete something important? Or transfer some money? Do you need to see the re
by bensummers 16y ago
What if that forged request was to a "create new account" URL, for example? Or to delete something important? Or transfer some money?
Do you need to see the response to do bad things?
- dminor 16y agoI think what he's saying is if your CSRF protection is based on a nonce, this vulnerability doesn't break it.
- nbpoole 16y agoNo, but that wasn't my point. My point was that this vulnerability can be (and has been) worked around by using nonces in the header. If you can see the response body, that protection becomes worthless as well (and there is no workaround for that).