5 ms·
Very interesting. > If you rely on CAPTCHA's as CSRF protection, make it consistent. This was discussed at today AppSecUSA [1] that it is rarely ever seen an
by yeukhon 13y ago
Very interesting.
> If you rely on CAPTCHA's as CSRF protection, make it consistent.
This was discussed at today AppSecUSA [1] that it is rarely ever seen anyone use CAPTCHA as CSRF protection.
[1]: http://appsecusa2013.sched.org/event/10d6389173e14b246720d8324ddbcc64?iframe=no&w=100&sidebar=yes&bg=no#.Uo7lm_ZQ2VQ http://appsecusa2013.sched.org/event/10d6389173e14b246720d83...
- dmak 13y agoAt first I thought it was odd and weird too. After some more thought, and correct me if I am wrong, there weren't any differences between them. They both are tokens that are generated and verified by the server, except a CAPTCHA actually requires human interaction.