News for hackers. Stuff that matters.

A comment on Show HN: This up votes itself. Parent comment

Re:Show HN: This up votes itself by simonw on Friday March 23, 2012 @04:44AM (#3744206)
But if the user IS signed in (and if someone arrives at your site from a link on Hacker News there's a very good chance they will be signed in) a POST forged from your site can affect their session. Read up on CSRF - it's a very different vulnerability from XSS (though having an XSS vulnerability will make any CSRF protection you have in place null and void).

http://en.wikipedia.org/wiki/CSRF

[ Parent | on HN ]
Re:Show HN: This up votes itself by Udo on Friday March 23, 2012 @05:54AM (#3744339)
Don't be so condescending, you didn't read my entire post. To quote myself:

  > POST (and restricting to same-origin)
I still don't think it's possible to forge the referer header on an uncompromised browser.
[ Parent | on HN ]