Re:Developers don't understand CORS
by jchw on Wednesday July 10, 2019 @05:20PM
(#20406696)
Actually they can do better than just a custom header with an XSRF token, which is fairly standard nowadays for requests that are authenticated via Session Cookies (Django for example strongly enforces this by default.)
[ Parent
| on HN ]
Re:Developers don't understand CORS
by tgsovlerkhgsel on Wednesday July 10, 2019 @05:38PM
(#20406861)
Indeed, this is the canonical way of avoiding CSRF (= XSRF) attacks. I intentionally only explained the header method because I didn't want to confuse readers with another concept, and because it's a really nice example to explain CORS.
https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... is probably one of the best documents discussing this, including the drawbacks of the header method that I used (and warned against) in my example:
https://github.com/OWASP/CheatSheetSeries/blob/master/cheats...