3 ms·
> I clicked it after I already had registered, and it showed > me notification about being part of hacker news group. So adding someone to an affiliation is a
by cfinke 15y ago
> I clicked it after I already had registered, and it showed
> me notification about being part of hacker news group.
So adding someone to an affiliation is as simple as getting them to ping a URL with a GET request? That doesn't seem especially secure.
- scq 15y agoNot secure at all. It's vulnerable to CSRF. Embedding an iframe with the url in a html page will cause all visitors to the page to get the affiliation. Proof of concept: http://s.dpth.tk/files/jigcsrf.html http://s.dpth.tk/files/jigcsrf.html Simply visiting the above page while logged in is sufficient to get the affiliation.
- irahul 15y ago> Embedding an iframe with the url in a html page will cause all visitors to the page to get the affiliation. Won't a simple <img src=...> work? Why go the iframe route? I don't think this is going to be the final affiliation implementation they are going to use. It's more like adding special touches for a community where he is showcasing, and they will turn it off in a day or two.