Re:Show HN: A Way To Hack HN's Karma
by daeken on Thursday March 22, 2012 @08:45PM
(#3742924)
CSRF protection is the right way to solve this. Switching to POST doesn't provide any real protection; an attacker can simply put up a form that autosubmits to the endpoint with POST.
[ Parent
| on HN ]
CSRF couldn't stop this particular attack, since it's not actually cross-site. You need to guard against both.
I think you misunderstand what CSRF protection does. It doesn't have anything to do with same-origin security, but rather preventing request forgery attacks in general. If a CSRF token was present on requests and was tied to a user's session (as is standard), then that would absolutely defend against this attack.
Wonder if you could get around that by submitting a javascript: link.