3 ms·
Browsers don't prevent it because there are legitimate uses for cross-domain posts. Good frameworks do prevent it with CSRF tokens.
by eurleif 15y ago
Browsers don't prevent it because there are legitimate uses for cross-domain posts. Good frameworks do prevent it with CSRF tokens.
- divtxt 15y agoI don't want the legitimate uses prevented. The default behavior should be to prevent, and the legitimate uses should explicitly opt-in. That way, you only have to do security analysis for those explicit points.
- eurleif 15y agoBut there's existing code that would break.
- tedivm 15y agoThis to me is a server side issue- but that doesn't necessarily mean it's on the app developer. The behavior you're talking about can be set most servers directly, by adding the "X-Frame-Options" header into every request by default. Then exceptions would have to be made explicitly, by either the server admin or application developer. If anyone should change the default behavior (which I am not convinced is the case) it should be the server developers, not the browsers.
- eurleif 15y agoX-Frame-Options only prevents the page from being displayed in a frame. It doesn't prevent a page on another domain from submitting a POST request.
- tedivm 15y agoCSRF is solved very simply by using tokens for each field. If the attacking site can't load the other page, it can't pull the token out, and without the token the post gets discarded. If you've abstracted your form generation this should be super simple to add.
- divtxt 15y agoThank you for pointing me to X-Frame-Origin! So, in the context of this discussion, why don't the browsers make X-Frame-Origin: DENY the default behavior?????
- tomjen3 15y agoCan you give some examples of legitemate post requests that need to work cross-domain.