4 ms·
Plain CSRF wouldn't help because they're scraping the site and executing the JS. It has to be time delayed CSRF so they give up and submit before it's loaded.
by earthboundkid 3y ago
Plain CSRF wouldn't help because they're scraping the site and executing the JS. It has to be time delayed CSRF so they give up and submit before it's loaded.
The real solution is to use a CAPTCHA, but they're so user hostile, that's the last resort.
- jpc0 3y agoOh I got that, I was referring to the original solution. And I can kind of agree with the CAPTCHA being the final solution, a question though, you can't implement the Cloudflare style "CAPTCHA" which is heuristics based and not "please click the bus" type?