News for hackers. Stuff that matters.

A comment on Securing your API: a modern alternative to CSRF tokens.

Re:Securing your API: a modern alternative to CSRF tokens by hamandcheese on Tuesday June 13, 2017 @10:28PM (#14550302)
> Firefox will not send the Origin header with any same-origin requests (bug)

Am I the only one very surprised to hear this? In 2017?

Is there any reason browsers shouldn't just send origin headers along with all requests? Why the exceptions?

[ Parent | on HN ]
Re:Securing your API: a modern alternative to CSRF tokens by skeggse on Wednesday June 14, 2017 @12:05AM (#14550589)
Well, it's a bug. It absolutely should send the origin header, but it doesn't ¯\_(ツ)_/¯
[ Parent | on HN ]
Re:Securing your API: a modern alternative to CSRF tokens by hamandcheese on Wednesday June 14, 2017 @12:25AM (#14550638)
I see that it's unclear, but my second set of questions was related to how chrome and safari don't send it for requests caused by img tags.
[ Parent | on HN ]