3 ms·
> He brought up the root cause -- that security could be beaten by disabiling cookies and javascript Wouldn't the root cause be allowing GET requests to perfor
by reedlaw 15y ago
> He brought up the root cause -- that security could be beaten by disabiling cookies and javascript
Wouldn't the root cause be allowing GET requests to perform destructive actions?
- pavel_lishin 15y agoI think the authentication problem is more dangerous. If you fix the GET issue, you're still allowing any savvy stranger to delete your articles by hand.
- mrfu 15y agoThere are two problems. 1: disabling cookies bypasses security checks 2: a GET request is not side-effect free The root cause is the combination of both issues.
- mekazu 15y agoThere is no more security in DELETE than there is in GET. Using DELETE over GET would only decrease accidental changes.