Show HN: This up votes itself

Re:Show HN: This up votes itself by Udo on Friday March 23, 2012 @02:21AM (#3743942)

In this specific case merely forging a POST request externally does nothing as the user has to be signed in for this to work. Thus, restricting actions such as voting to POST (and restricting to same-origin) does constitute adequate protection if there is no XSS vulnerability on the site.

[ Parent | on HN ]

Re:Show HN: This up votes itself by simonw on Friday March 23, 2012 @04:44AM (#3744206)

But if the user IS signed in (and if someone arrives at your site from a link on Hacker News there's a very good chance they will be signed in) a POST forged from your site can affect their session. Read up on CSRF - it's a very different vulnerability from XSS (though having an XSS vulnerability will make any CSRF protection you have in place null and void).

http://en.wikipedia.org/wiki/CSRF

[ Parent | on HN ]

Re:Show HN: This up votes itself by Udo on Friday March 23, 2012 @05:54AM (#3744339)

Don't be so condescending, you didn't read my entire post. To quote myself:

  > POST (and restricting to same-origin)

I still don't think it's possible to forge the referer header on an uncompromised browser.

[ Parent | on HN ]

Re:Show HN: This up votes itself by sp332 on Friday March 23, 2012 @05:12PM (#3747325)

Would restricting to same-origin break http://hackerne.ws?

[ Parent | on HN ]