4 ms·
Actually, this is CSRF (and it's pretty smart - smarter than your average XSS attack).
by chrisbroadfoot 18y ago
Actually, this is CSRF (and it's pretty smart - smarter than your average XSS attack).
- blasdel 18y agoscript src-ing the JSON document is pretty clever. It could be totally stopped by using a nonce in a header. You should already have implemented a nonce system for form submissions anyway.