News for hackers. Stuff that matters.

A comment on How to boost your popularity on OkCupid using CSRF and a JSON type confusion. Parent comment

Re:How to boost your popularity on OkCupid using CSRF and a ... by faeyanpiraat on Tuesday August 03, 2021 @04:05AM (#28046763)
Or you could trigger an ajax call on the page that actually checks the token validity then redirect the user to a new password or a sorryexpired form.

Gmail may fetch the page but wont run the js on it.

Edit: this works for situations when spam filters fetch the links as soon as the mail arrives.

[ Parent | on HN ]
Re:How to boost your popularity on OkCupid using CSRF and a ... by labawi on Tuesday August 03, 2021 @04:29AM (#28046898)
Yes, please ruin functionality without javascript for the sake of gmail's nosiness.

Comment about a form and PUT/POST is good - it will work by standards in any browser, even when gmail starts executing javascript. Add auto-submit on top javascript if preferred.

[ Parent | on HN ]