4 ms·
AOL does a lot of weird things. Last year, jrecursive actually observed that their servers would make an HTTP GET for any URL passed over an AIM conversation. L
by aphyr 14y ago
AOL does a lot of weird things. Last year, jrecursive actually observed that their servers would make an HTTP GET for any URL passed over an AIM conversation. Looks like that doesn't happen any more, though.
- deleted 14y ago[deleted]
- lmm 14y agoI don't think that's particularly crazy. It allows them to do antiphishing (at some cost to the user's privacy, but if you object to that you're not going to be on AOL), and as someone running an HTTP server on the public internet you should expect to receive arbitrary GETs from random sources.
- pjscott 14y agoThe moral of that story is, don't do anything in response to a GET request that you don't want randomly triggered by bots. That's what POST and PUT are for.
- baddox 14y agoOf course, there's nothing stopping AOL from doing a POST or PUT request either, or a DELETE for that matter.
- nkassis 14y agoUsing CSRF token should protect against that and is good practice.
- aphyr 14y agoCSRF won't protect against traffic sniffing; only third parties constructing URLs.
- derleth 14y agoBy that logic, there's nothing stopping AOL bots from flooding your domain with TCP SYN requests and taking you down. It would be sinful, but it's possible. The point of standards is to provide a place for people to meet each other halfway. Protocol standards especially.