3 ms·
Not if the page simply a normal page that you would type in your URL. CSRF doesn't make sense there. I could send you a link to facebook.com with an embedded sc
by jlongster 15y ago
Not if the page simply a normal page that you would type in your URL. CSRF doesn't make sense there. I could send you a link to facebook.com with an embedded script.
- brlewis 15y agoIf the page accepts URL parameters or POST data, CSRF makes perfect sense.
- judofyr 15y ago> If the page accepts URL parameters … CSRF makes perfect sense. No, it doesn't. CSRF makes perfect sense when there is data on the server that is being modified by a request. A simple "search.php?query=…" doesn't need CSRF protection. If you're passing parameters that modify the server in the URL (instead of a part of the post data) you're using HTTP wrong and adding CSRF protection in the query string is the wrong solution.
- brlewis 15y agoYou're right about the search example. That doubles the list of demonstrated vulnerabilities in this article from 1 to 2. I certainly agree that using GET for changing server state would be wrong. I don't know if any of the examples in the article work that way, since all we're provided with is a screenshot with an alert box. That's demonstrated sloppiness on Apple's web site, but not enough information to demonstrate vulnerability. (I'm definitely voting up your reply for intelligent discussion.)