3 ms·
It's not so hard to build a form and submit it automatically with JavaScript in order to get a user's browser to do a POST request to any URL you want.
by Ded7xSEoPKYNsDd 12y ago
It's not so hard to build a form and submit it automatically with JavaScript in order to get a user's browser to do a POST request to any URL you want.
- Someone1234 12y agoThat form wouldn't be on the same domain and therefore would hit CSRF protections.
- Ded7xSEoPKYNsDd 12y agoYes, if you require a user-specific random token in the request, the exploit doesn't work. But that's independent of GET/POST and not what you said in your earlier post.