Node.js adds support for direct registry-less HTTPS imports

Re:Node.js adds support for direct registry-less HTTPS imports by horsawlarway on Thursday February 10, 2022 @06:33PM (#30294385)

This just isn't true. I don't consider request forgery to just be side-effect based (the classic example of a bank form post). I'm including any request that leaks data to a site based on cookies present only on the client (forged authenticated request).

SOP/CORS was the foundation that allowed CSRF tokens to even work. (No SOP/CORS? Just request the form with the csrf token first, parse with js, append to next request)

I guess you could say SOP is really the protecting force here, but CORS only exists because strict SOP broke a LOT of stuff. Enter trust zones in IE, and then CORS.

SameSite now mostly tackles this by fixing the root issue with the cookie jar.

[ Parent | on HN ]

Re:Node.js adds support for direct registry-less HTTPS imports by merb on Tuesday February 15, 2022 @07:42PM (#30354994)

cors never protected against csrf because you could just have a form that gets submitted via js. that worked for ALL post requests and it works in modern browsers as well and most csrf attackes used forms.

[ Parent | on HN ]