4 ms·
> The difference between browser-based CSRF protections (which don't exist) What about the X-Frame-Options and Origin headers? They are browser-based mechanism
by majke 15y ago
> The difference between browser-based CSRF protections (which don't exist)
What about the X-Frame-Options and Origin headers? They are browser-based mechanisms that hint server side, right?
(not for the classic POST case though...)
- tptacek 15y agoNeal addressed XFO downthread: http://news.ycombinator.com/item?id=3778700 http://news.ycombinator.com/item?id=3778700 Read his comment. It's great.