3 ms·
"Remember that if a user is logged in, an external site can have code like img src="http://yoursite/op.cgi?delete=all http://yoursite/op.cgi?delete=all"" You s
by natrius 19y ago
"Remember that if a user is logged in, an external site can have code like img src="http://yoursite/op.cgi?delete=all http://yoursite/op.cgi?delete=all""
You shouldn't be using GET for anything that has side effects.
- antirez 19y agoGood point, but with ajax this is very common. There are also frameworks that abstract "params" into GET+POST+COOKIES, since they are all under user control in theory the security level is the same, but actually the img trick changes this.
- tuukkah 19y agoYou probably know this, but the same is applicable to "cross-site request forgeries" in general, they just aren't as trivial to exploit as img src. If they can perform a GET they can perhaps use javascript to import confidential information into a loaded page and scrape that. POST requests aren't safe from tricks by third-party sites either, as is mentioned here for example: http://www.owasp.org/index.php/Cross-Site_Request_Forgery http://www.owasp.org/index.php/Cross-Site_Request_Forgery (Open Web Application Security Project looks interesting otherwise too.)