4 ms·
> The trick is to only allow logins from users that are carrying at least one cookie which you have set in that way—since you know that those cookies could not
by colinclerk 5y ago
> The trick is to only allow logins from users that are carrying at least one cookie which you have set in that way—since you know that those cookies could not have been sent if the user originated in a form on another site.
It's crazy to me that HTTP servers need to rely on tricks like this to understand the context of a request.
At a minimum, it would be nice if `Origin` was sent with all requests from browsers, not just cross-origin XHR requests.
- ozim 5y agoThis is s problem with stateless approach for HTTP protocol. When it was conceived it was not a problem at all. Maybe we need a statefull protocol for web-apps -- where stateless is still good for web-pages. Now we have statefull web-apps based on stateless protocol - what could go wrong? Developers making mistakes, just like managed vs unmanaged memory.
- edoceo 5y agoIt's not crazy and it's not a trick. The Context: that's an app-layer concern, not a protocol layer concern.
- simonw 5y agoAs far as I can tell Origin: is also sent by regular HTTP POST requests these days. I added a note about Origin to the post.