4 ms·
I suppose these particular paths aren't as exploitable as a logout (which isn't a GET on Twitter, either, it seems), but what about, e.g., Chrome's link prefetc
by graue 14y ago
I suppose these particular paths aren't as exploitable as a logout (which isn't a GET on Twitter, either, it seems), but what about, e.g., Chrome's link prefetching? I'm not sure how it would know not to prefetch, for instance, the "cancel email confirmation" link.
Anyway, I'm teaching myself Clojure right now and this looks like great sample code to study, so thank you for sharing it.
- xavi 14y agoFrom what I understand, Chrome doesn't prefetch HTTPS URLs https://developers.google.com/chrome/whitepapers/prerender https://developers.google.com/chrome/whitepapers/prerender but Firefox does https://developer.mozilla.org/en-US/docs/Link_prefetching_FAQ#Are_there_any_restrictions_on_what_is_prefetched.3F https://developer.mozilla.org/en-US/docs/Link_prefetching_FA... So, using HTTPS could be a way to avoid prefetching, but it would not always work. In any case, I've already committed the changes that you suggested, so now noir-auth-app is free from these problems.