Just Delete Me – A directory of direct links to delete your account

Re:Just Delete Me – A directory of direct links to delete yo... by vortico on Monday September 02, 2019 @11:22AM (#20859630)

Any site that has a GET route to /logout that does not check the referrer is vulnerable to this iframe/img attack.

[ Parent | on HN ]

Re:Just Delete Me – A directory of direct links to delete yo... by _jomo on Monday September 02, 2019 @04:28PM (#20861563)

Please don't rely on the Referer being present (ever). It's an optional header to send in a request and you can configure your browser — at least Firefox — to not send it for privacy reasons.

Logout (or anything else that triggers changes of any kind) shouldn't be a GET request.

[ Parent | on HN ]

Re:Just Delete Me – A directory of direct links to delete yo... by throwaway63839 on Monday September 02, 2019 @04:29PM (#20861569)

Not true. Using samesite cookie attribute prevents CSRF through IMG tags. (On browsers that support samesite, i.e. most browsers.)

[ Parent | on HN ]

Re:Just Delete Me – A directory of direct links to delete yo... by yjftsjthsd-h on Monday September 02, 2019 @12:26PM (#20860075)

It really shouldn't be GET anyways; that's asking for trouble.

[ Parent | on HN ]

Re:Just Delete Me – A directory of direct links to delete yo... by iwalton3 on Monday September 02, 2019 @01:10PM (#20860450)

Some of the pages that are exploited do use POST though. If it accepts authorization through a cookie and doesn't require an XSRF token or JSON content type, it is probably vulnerable.

But yes in general making actions happen in response to a GET request is generally a bad idea, since these are often cached and considered "safe" to retry.

[ Parent | on HN ]