3 ms·
The moral of that story is, don't do anything in response to a GET request that you don't want randomly triggered by bots. That's what POST and PUT are for.
by pjscott 14y ago
The moral of that story is, don't do anything in response to a GET request that you don't want randomly triggered by bots. That's what POST and PUT are for.
- baddox 14y agoOf course, there's nothing stopping AOL from doing a POST or PUT request either, or a DELETE for that matter.
- nkassis 14y agoUsing CSRF token should protect against that and is good practice.
- aphyr 14y agoCSRF won't protect against traffic sniffing; only third parties constructing URLs.
- derleth 14y agoBy that logic, there's nothing stopping AOL bots from flooding your domain with TCP SYN requests and taking you down. It would be sinful, but it's possible. The point of standards is to provide a place for people to meet each other halfway. Protocol standards especially.