News for hackers. Stuff that matters.

A comment on #1 CSRF Is A Vulnerability In All Browsers. Parent comment

Re:#1 CSRF Is A Vulnerability In All Browsers by majke on Friday March 30, 2012 @10:00PM (#3779048)
> The difference between browser-based CSRF protections (which don't exist)

What about the X-Frame-Options and Origin headers? They are browser-based mechanisms that hint server side, right?

(not for the classic POST case though...)

[ Parent | on HN ]
Re:#1 CSRF Is A Vulnerability In All Browsers by tptacek on Saturday March 31, 2012 @12:27AM (#3779350)
Neal addressed XFO downthread:

http://news.ycombinator.com/item?id=3778700

Read his comment. It's great.

[ Parent | on HN ]