4 ms·
And I can put that delete URI in an <img src=""> and have your browser or iPhone email automatically destroy your document before you can stop it.
by sunir 13y ago
And I can put that delete URI in an <img src=""> and have your browser or iPhone email automatically destroy your document before you can stop it.
- bluefinity 13y agoYou can do the same thing with POST by submitting a form with JS. The correct way to protect against this sort of thing is to use a CSRF token.
- oneeyedpigeon 13y agoSubmitting a form with JS is a whole other level of complexity than just having a link out there in the wild that performs write operations. And using a CSRF defeats that stated intent.
- jheising 13y agoYes and if I were a hacker, I could do the same thing with curl. Either way the only person who's likely to do it is someone who is technically savvy.