5 ms·
Or xhr with custom header, if you don't want to have to keep track of state.
by rabidsnail 15y ago
Or xhr with custom header, if you don't want to have to keep track of state.
- simonster 15y agoA custom header is not sufficient (blame Flash): http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-February/007533.html http://lists.webappsec.org/pipermail/websecurity_lists.webap...
- kijin 15y agoSo that anyone who has JavaScript disabled will be treated like an attacker? No thanks, HN is one of very few sites nowadays that work fine without JavaScript tricks, and I'd much rather PG kept it that way.