7 ms·
Either you do it for everything, or you do it for only POST and you end up missing half of the vulnerabilities. Correct me if I'm wrong, but your CSRF attack us
by Xk 14y ago
Either you do it for everything, or you do it for only POST and you end up missing half of the vulnerabilities. Correct me if I'm wrong, but your CSRF attack used a GET request, did it not? [1]
Web applications make state-changing operations on GET requests. You might not like it, but they do.
[1] <img src="https://mail.google.com/mail/u/0/?logout https://mail.google.com/mail/u/0/?logout style="display: none;" />
- homakov 14y ago>Web applications make state-changing operations on GET requests. You might not like it, but they do. but when developer made a mistake with GET it is 100% his problem - it's out of question. he should be punished :D
- tptacek 14y agoNonsensical. CSRF isn't God's punishment for REST-lessness.
- baddox 14y agoYou're both just choosing different places to draw the line between developer responsibility and browser responsibility.
- tptacek 14y agoThat is like saying "you're both just suggesting two totally different designs for the HTTP security model". His model is wrong. Again: I assume he wants to know that, so, bluntness.