3 ms·
> I reported the issue to Coursera on Sunday, and I have not yet received a response. Possible remediation steps include rate limiting (again), referrer checkin
by yeukhon 12y ago
> I reported the issue to Coursera on Sunday, and I have not yet received a response. Possible remediation steps include rate limiting (again), referrer checking, and configuring APIs to always return the same HTTP status.
Wouldn't the 2nd issue (the cross-origin data leak) be better off solved by having a CSRF token instead?
- shortstuffsushi 12y agoThat would presumably solve this issue. Perhaps that is what they will end up doing -- hard to say since they haven't addressed this issue yet. The author was guessing at solutions that might help (though, as you've noted, he was mostly off base).
- yeukhon 12y agoI don't mean to say his suggestion is bad. For what it is worth, I just want to clarify this :) I too, am not too good with security stuff either (still learning!) and thanks! Seriously though, he's the kind of privacy person you wouldn't think you'd be listening to a law textbook because he obviously is pretty good with web technology.
- shortstuffsushi 12y agoHey, you've got other interests aside from coding, don't you? Some people like to bike, some like to play games, some like to study law. Some like to do all three ;)