3 ms·
This just isn't true. I don't consider request forgery to just be side-effect based (the classic example of a bank form post). I'm including any request that l
by horsawlarway 5y ago
This just isn't true. I don't consider request forgery to just be side-effect based (the classic example of a bank form post). I'm including any request that leaks data to a site based on cookies present only on the client (forged authenticated request).
SOP/CORS was the foundation that allowed CSRF tokens to even work. (No SOP/CORS? Just request the form with the csrf token first, parse with js, append to next request)
I guess you could say SOP is really the protecting force here, but CORS only exists because strict SOP broke a LOT of stuff. Enter trust zones in IE, and then CORS.
SameSite now mostly tackles this by fixing the root issue with the cookie jar.
- merb 5y agocors never protected against csrf because you could just have a form that gets submitted via js. that worked for ALL post requests and it works in modern browsers as well and most csrf attackes used forms.