News for hackers. Stuff that matters.

A comment on Securing your API: a modern alternative to CSRF tokens. Parent comment

Re:Securing your API: a modern alternative to CSRF tokens by skeggse on Wednesday June 14, 2017 @12:05AM (#14550589)
Well, it's a bug. It absolutely should send the origin header, but it doesn't ¯\_(ツ)_/¯
[ Parent | on HN ]
Re:Securing your API: a modern alternative to CSRF tokens by hamandcheese on Wednesday June 14, 2017 @12:25AM (#14550638)
I see that it's unclear, but my second set of questions was related to how chrome and safari don't send it for requests caused by img tags.
[ Parent | on HN ]