4 ms·
CSRF protection is not about preventing bots from interacting with your site - it's about protecting your site from other sites (hence the name - cross site req
by charliesome 13y ago
CSRF protection is not about preventing bots from interacting with your site - it's about protecting your site from other sites (hence the name - cross site request forgery).
Without the hidden 'fnid' input, it would be possible for other sites to vote on and post content to Hacker News on your behalf without your consent.
- shuzchen 13y agoMore specifically, it's protecting your site from other sites taking advantage of the fact that you're already logged in. For example, in the absence of CSRF, if you're logged into HN, any other site could just embed a form element using the right input IDs, and make submissions on your behalf (clicked on this link? just made a post on your behalf. moved your mouse a little to the left? just upvoted this post). The "hack" outlined in the article requires knowing the username and password of the person you want to "hack". Of course CSRF tokens don't protect you when your credentials are lost.