4 ms·

Thanks. That's good advice.

• weird-eye-issue 5y ago
  Btw you could just have JS do a POST request, the user doesn't need to do anything except open the page. This is how unsubscribe pages work.
  • kevin_thibedeau 5y ago
    That presumes everyone executes random JS or has a browser that supports it.
    • aendruk 5y ago
      It should go without saying that you provide a fallback.
    • input_sh 5y ago
      Create a "click here" button, hide it by adding it a class or a style with JS.
      • kevin_thibedeau 5y ago
        There is this thing called an HTML form. Every browser supports it.
  • bawolff 5y ago
    Depending on context and implementation details, this can often be a security issue (csrf or something similar). Probably not in the unsubscribe case though
    • weird-eye-issue 5y ago
      Obviously you need to make sure your API is not susceptible to CSRF but that goes without saying... Should I also tell him to password protect his database? :P
      • bawolff 5y ago
        If you follow what the parent is suggesting (open a page with a get request that has js which does a post request automatically with no user interaction), its probably impossible to not be susceptible to csrf
        • weird-eye-issue 5y ago
          I'm really not sure why you think that, but that's just not true at all. For starters, if it is a JSON API then a CORS request will be done for all cross-domain API requests. Even a missing CORS configuration would then block the CORS request from third-party domains.
          • bawolff 5y ago
            So the situation is: there is some url you open (with a normal get request. Typically but not neccesarily from an email), then that url does the non-idempotent POST request without any futher user interaction. A malicious page that knows the url used in the email could open the url from the email in a popup. The js will execute in the popup, and do the POST request. It doesn't matter how much csrf protection you have on the POST step, if anyone can trigger it with no user interaction just by opening some page with a GET request.
            • weird-eye-issue 5y ago
              > A malicious page that knows the url used in the email could open the url from the email in a popup Sorry but this whole scenario is just ridiculous. If somebody can access your email it is already game over. It doesn't matter what web technology you are using at the that point, user interaction or not. If a "malicious page" knows the URL it doesn't matter at all because it means it is capable of arbitrary code execution and that point it could just exfiltrate the URL to somebody or a Chromium instance to perform the user interaction. Actually if the page can open a popup I think it could also execute JavaScript within the context of the page and perform the user interaction right there.
  • _wldu 5y ago
    Thanks. I don't use JS, just Go with HTML templates. I populate the form now with {{ .code }} from the URL so the user does not have to copy/paste the code. But they do have to click 'Submit' to post the form. I think this is a reasonable approach that most users are OK with.
    • weird-eye-issue 5y ago
      You could add a single line of JS to have it auto submitted as well
      • _wldu 5y ago
        Wouldn't that be equivalent to just doing a GET?
        • SamBam 5y ago
          No, because if you curl the original url the POST for the second url won't be triggered, but if you navigate your browser to the url, the browser will trigger the POST.
        • weird-eye-issue 5y ago
          No... Because you have to do a GET, execute JavaScript, and make a POST request. Bots don't execute JavaScript and no well-behaved bots are going to make POST requests