3 ms·
Not secure at all. It's vulnerable to CSRF. Embedding an iframe with the url in a html page will cause all visitors to the page to get the affiliation. Proof
by scq 15y ago
Not secure at all. It's vulnerable to CSRF.
Embedding an iframe with the url in a html page will cause all visitors to the page to get the affiliation.
Proof of concept: http://s.dpth.tk/files/jigcsrf.html http://s.dpth.tk/files/jigcsrf.html
Simply visiting the above page while logged in is sufficient to get the affiliation.
- irahul 15y ago> Embedding an iframe with the url in a html page will cause all visitors to the page to get the affiliation. Won't a simple <img src=...> work? Why go the iframe route? I don't think this is going to be the final affiliation implementation they are going to use. It's more like adding special touches for a community where he is showcasing, and they will turn it off in a day or two.