3 ms·

Stupid question. Is this originOnly proposal about the problem that a document from evil.com can drive requests to victim.com (e.g. img, iframe, clickjacking fo

by pekk 14y ago

Stupid question. Is this originOnly proposal about the problem that a document from evil.com can drive requests to victim.com (e.g. img, iframe, clickjacking form, AJAX) and that these user-unintended requests to victim.com will stupidly include the cookies set by victim.com? Or some other problem?

MindTwister 14y ago
As far as I understand it, yes. The basic idea is that any requests that do not originate from the domain will not send the cookies, preventing CSRF, clickjacking and the advanced CSRF discussed here yesterday (from stackoverflow: http://stackoverflow.com/q/2669690/3287 http://stackoverflow.com/q/2669690/3287)
- homakov 14y ago
  Yes!