4 ms·
> If the page accepts URL parameters … CSRF makes perfect sense. No, it doesn't. CSRF makes perfect sense when there is data on the server that is being modif
by judofyr 15y ago
> If the page accepts URL parameters … CSRF makes perfect sense.
No, it doesn't.
CSRF makes perfect sense when there is data on the server that is being modified by a request. A simple "search.php?query=…" doesn't need CSRF protection.
If you're passing parameters that modify the server in the URL (instead of a part of the post data) you're using HTTP wrong and adding CSRF protection in the query string is the wrong solution.
- brlewis 15y agoYou're right about the search example. That doubles the list of demonstrated vulnerabilities in this article from 1 to 2. I certainly agree that using GET for changing server state would be wrong. I don't know if any of the examples in the article work that way, since all we're provided with is a screenshot with an alert box. That's demonstrated sloppiness on Apple's web site, but not enough information to demonstrate vulnerability. (I'm definitely voting up your reply for intelligent discussion.)