3 ms·
Seriously, why are they not using tokens on every request? A simple md5(user_id + salt) would be more than enough.
by rorrr 16y ago
Seriously, why are they not using tokens on every request? A simple md5(user_id + salt) would be more than enough.
- nbpoole 16y agoThey do, and have for some time (although I can't vouch for the particular algorithm used). fb_dtsg is the usual parameter name. Unfortunately, an XSS vulnerability by its very nature allows an attacker to subvert those protections.
- ltamake 16y agoThey do, but they're useless against XSS attacks.