3 ms·
The Origin header can be used to protect against CRSF. It's OK that the header is not useful for much more than this important task.
by BarkMore 14y ago
The Origin header can be used to protect against CRSF. It's OK that the header is not useful for much more than this important task.
- arunoda 14y agoI'm not a security expert. Does CRSF also works with WebSockets? How it can be prevented using Origin header?
- BarkMore 14y agoDoes CRSF also works with WebSockets? The browser sends cookies in the websocket handshake. If the server application uses the cookies for authentication, then a malicious web site can act on behalf of a user without the user's knowledge. How it can be prevented using Origin header? The server application can reject requests originating from other sites.
- arunoda 14y agoThanks. I'm clear now.