Also, some context on Google's stance regarding this "hole": http://cryptogasm.com/2012/02/does-google-understand-csrf/ http://cryptogasm.com/2012/02/does-googl

Also, some context on Google's stance regarding this "hole": http://cryptogasm.com/2012/02/does-google-understand-csrf/ http://cryptogasm.com/2012/02/does-google-understand-csrf/ If implemented correctly, it shouldn't be an issue, for example with Rail's authenticity_token: http://mysteps4learning.wordpress.com/2012/10/03/how-authenticity-token-works-in-rails/ http://mysteps4learning.wordpress.com/2012/10/03/how-authent...