3 ms·
Wait, from reading the article it looks like the link they send to their users send them to a page with some javascript which automatically POST data for them.
by arkh 2y ago
Wait, from reading the article it looks like the link they send to their users send them to a page with some javascript which automatically POST data for them. Which MS will correctly do: your "POST" is in fact a simple GET for most users with javascript on.
What you should do is send your user to a page with a form requiring a manual action from them.
- badmintonbaseba 2y agoThis just highlights how the security scanning is just theater though. So bad actors can now just have their evil content behind a form, and users get accustomed to the double opt-in workflow anyway.
- arkh 2y agoYup, best thing would be to either have a form in your email / SMS or let's get crazy: implement POST links (and maybe DELETE ones too). Your client knows it will change things when followed (so security clients and prefetchers won't open it), the server receive a POST request, and it's a one click action for the user.