News for hackers. Stuff that matters.

A comment on CSRF Attack using JavaScript.

Re:CSRF Attack using JavaScript by yaix on Friday March 09, 2012 @12:45PM (#3685094)
The only thing to ever put in a cookie is the SESSION ID! Never put any user credentials into a cookie!

If you need the user's email or name on the client, put it into the HTML or load it via AJAX.

[ Parent | on HN ]

There are no comments on this comment yet.