2 ms·
A CSRF is an attack against a logged in user, so has to be mediated via their browser. If you can spoof the origin header of a second party when they navigate
by masklinn 1y ago
A CSRF is an attack against a logged in user, so has to be mediated via their browser.
If you can spoof the origin header of a second party when they navigate to a third party, a CSRF is a complete waste of whatever vulnerability you have found.