4 ms·
Is the following accurate: If a form is served from domain A (via GET) in to an iframe on a page that was served from domain B, then the JS on the page from do
by euroclydon 15y ago
Is the following accurate:
If a form is served from domain A (via GET) in to an iframe on a page that was served from domain B, then the JS on the page from domain B is prevented from reading or writing data on the page from domain A (unless an x-domain policy is in place) though it may be able to post it.
- meow 15y agoYes it wont be able to read it. But that's not what they are after. What they do want is to execute some user action on the server side. So this action would have taken place just by executing the GET/POST request.
- euroclydon 15y agoThank you. I just wanted to make sure I understood the basis of why CRSF Tokens work.