Just Delete Me – A directory of direct links to delete your account

Re:Just Delete Me – A directory of direct links to delete yo... by yjftsjthsd-h on Monday September 02, 2019 @11:19AM (#20859609)

I'm surprised that isn't blocked by cross-site scripting prevention or something along those lines. Shouldn't forcing logout require that you have the cookie that proves that you're logged in in the first place?

[ Parent | on HN ]

Re:Just Delete Me – A directory of direct links to delete yo... by vortico on Monday September 02, 2019 @11:22AM (#20859630)

Any site that has a GET route to /logout that does not check the referrer is vulnerable to this iframe/img attack.

[ Parent | on HN ]

Re:Just Delete Me – A directory of direct links to delete yo... by _jomo on Monday September 02, 2019 @04:28PM (#20861563)

Please don't rely on the Referer being present (ever). It's an optional header to send in a request and you can configure your browser — at least Firefox — to not send it for privacy reasons.

Logout (or anything else that triggers changes of any kind) shouldn't be a GET request.

[ Parent | on HN ]

Re:Just Delete Me – A directory of direct links to delete yo... by throwaway63839 on Monday September 02, 2019 @04:29PM (#20861569)

Not true. Using samesite cookie attribute prevents CSRF through IMG tags. (On browsers that support samesite, i.e. most browsers.)

[ Parent | on HN ]

Re:Just Delete Me – A directory of direct links to delete yo... by yjftsjthsd-h on Monday September 02, 2019 @12:26PM (#20860075)

It really shouldn't be GET anyways; that's asking for trouble.

[ Parent | on HN ]

Re:Just Delete Me – A directory of direct links to delete yo... by iwalton3 on Monday September 02, 2019 @01:10PM (#20860450)

Some of the pages that are exploited do use POST though. If it accepts authorization through a cookie and doesn't require an XSRF token or JSON content type, it is probably vulnerable.

But yes in general making actions happen in response to a GET request is generally a bad idea, since these are often cached and considered "safe" to retry.

[ Parent | on HN ]

Re:Just Delete Me – A directory of direct links to delete yo... by hirsin on Monday September 02, 2019 @11:30AM (#20859682)

This is tricky - it's up to the site basically. For single site websites (hacker news, let's say) then yeah - samesite should be enabled to prevent this.

For a large IDP like Google, Facebook, Microsoft, etc, you start to want* logout via cross-site requests, but it needs to be protected against DoS attacks like the link provided. So you need some other proof that the requesting site has a session - a session ID, an ID token, a unique identifier for one of the users in session (this is the least bulletproof one).

* well, standards wise at least. Google doesn't document a logout url anymore.

[ Parent | on HN ]