Re:Blizzard games were vulnerable to DNS rebinding attack
by andrewstuart2 on Monday January 22, 2018 @04:46PM
(#16208217)
Developer 102 (or perhaps entrance exam): Never return authorization credentials on an unauthenticated HTTP endpoint.
[ Parent
| on HN ]
Re:Blizzard games were vulnerable to DNS rebinding attack
by f2n on Monday January 22, 2018 @06:48PM
(#16209341)
It says Authorization, but this is really more of an anti-CSRF token, not an actual authorization credential, and anti-CSRF tokens are completely legitimate to return over an unauthenticated HTTP endpoint.