News for hackers. Stuff that matters.

A comment on #1 CSRF Is A Vulnerability In All Browsers. Parent comment

Re:#1 CSRF Is A Vulnerability In All Browsers by euroclydon on Friday March 30, 2012 @08:49PM (#3778871)
Is the following accurate:

If a form is served from domain A (via GET) in to an iframe on a page that was served from domain B, then the JS on the page from domain B is prevented from reading or writing data on the page from domain A (unless an x-domain policy is in place) though it may be able to post it.

[ Parent | on HN ]
Re:#1 CSRF Is A Vulnerability In All Browsers by meow on Saturday March 31, 2012 @02:44AM (#3779619)
Yes it wont be able to read it. But that's not what they are after. What they do want is to execute some user action on the server side. So this action would have taken place just by executing the GET/POST request.
[ Parent | on HN ]
Re:#1 CSRF Is A Vulnerability In All Browsers by euroclydon on Saturday March 31, 2012 @08:27AM (#3780163)
Thank you. I just wanted to make sure I understood the basis of why CRSF Tokens work.
[ Parent | on HN ]