4 ms·

How is this a DoS? It's not significantly more resource-intensive than any other request. If you could submit enough of these requests to DoS the server, you co

How is this a DoS? It's not significantly more resource-intensive than any other request. If you could submit enough of these requests to DoS the server, you could submit enough of any request to DoS the server, so the server is no more vulnerable this way than otherwise.

tedunangst 15y ago
It allows you to grief the users of any rails site. You can log them out at will (for some value of at will). In the dawn of time, you could use a CSRF exploit and really grief the users. Then CSRF checking made that go away. This is now a step backwards, where 3rd party sites can affect your users.
- subwindow 15y ago
  You can't log any arbitrary out of their sessions. It only resets your session, as in the session cookie is reset.
  - quotemstr 15y ago
    No, you, as an evil website operator, can cause anyone who visits your site to log out of any arbitrary rails site.