4 ms·
On one hand, I do agree that it is very annoying. However, I can kind of understand. There may be a way around this, but if no session was required, then could
by bilalq 13y ago
On one hand, I do agree that it is very annoying. However, I can kind of understand.
There may be a way around this, but if no session was required, then couldn't someone just make a bunch of GET requests to the unsubscribe url for each user id and unsubscribe the entire user base?
- Avalaxy 13y agoWell, I think most professional developers would use a GUID for each user anyway. Good luck bruteforcing that.
- rhizome 13y agoYes, this is a solved problem.
- InclinedPlane 13y agoJust use CSRF tokens.
- bilalq 13y agoYeah, I don't know why I didn't think of that. In that case, there really isn't any justification.