News for hackers. Stuff that matters.

A comment on CSRF is really dead. Parent comment

Re:CSRF is really dead by edoceo on Saturday September 07, 2019 @05:49PM (#20906777)
When you send a PATCH request, and include a token of the object you're patching, so the system knows your using an up-to-date object? In that REST like example that hash/token on the object is the same function as CSRF-token. I see this model on APIs daily.
[ Parent | on HN ]
Re:CSRF is really dead by AmericanChopper on Saturday September 07, 2019 @06:01PM (#20906843)
That sounds more like an integrity check than a CSRF control. Unless you have poor CORs settings, wouldn’t SOP prevent CSRF on PATCH endpoints anyway?
[ Parent | on HN ]
Re:CSRF is really dead by edoceo on Saturday September 07, 2019 @06:20PM (#20906982)
It's that too. My point (still) being that passing state keys is old, common and still in use.
[ Parent | on HN ]