3 ms·
One legit reason is to set a CSRF cookie. If there's a login or signup form on the page, many frameworks add a CSRF field to the form that should match the cook
by diafygi 12y ago
One legit reason is to set a CSRF cookie. If there's a login or signup form on the page, many frameworks add a CSRF field to the form that should match the cookie. When you POST the form, the cookie and the field must match.
- PeterWhittaker 12y agoSure, that's legit - if login or signup is required. But for pages containing information intended to encourage a user to spend time on a site, to get convinced they need to sign-up, it's counter-productive.