News for hackers. Stuff that matters.

A comment on Securing your API: a modern alternative to CSRF tokens.

Re:Securing your API: a modern alternative to CSRF tokens by Retr0spectrum on Tuesday June 13, 2017 @06:39PM (#14549274)
The author admits that this solution won't work for "older" browsers. Which browser versions specifically?
[ Parent | on HN ]
Re:Securing your API: a modern alternative to CSRF tokens by nevir on Tuesday June 13, 2017 @06:43PM (#14549300)
https://caniuse.com/#feat=cors and hit "show all"

TL;DR - evergreen browsers, mobile browsers (except for images), IE 11+, and IE 8+ partially supports it

[ Parent | on HN ]
Re:Securing your API: a modern alternative to CSRF tokens by skeggse on Wednesday June 14, 2017 @12:08AM (#14550594)
For our specific solution, we also rely on (partial) support for Referrer-Policy: https://caniuse.com/#feat=referrer-policy
[ Parent | on HN ]