News for hackers. Stuff that matters.

A comment on #1 CSRF Is A Vulnerability In All Browsers. Parent comment

Re:#1 CSRF Is A Vulnerability In All Browsers by homakov on Friday March 30, 2012 @11:15PM (#3779212)
>Web applications make state-changing operations on GET requests. You might not like it, but they do.

but when developer made a mistake with GET it is 100% his problem - it's out of question. he should be punished :D

[ Parent | on HN ]
Re:#1 CSRF Is A Vulnerability In All Browsers by tptacek on Friday March 30, 2012 @11:23PM (#3779228)
Nonsensical. CSRF isn't God's punishment for REST-lessness.
[ Parent | on HN ]
Re:#1 CSRF Is A Vulnerability In All Browsers by baddox on Saturday March 31, 2012 @04:33AM (#3779820)
You're both just choosing different places to draw the line between developer responsibility and browser responsibility.
[ Parent | on HN ]
Re:#1 CSRF Is A Vulnerability In All Browsers by tptacek on Saturday March 31, 2012 @12:17PM (#3780647)
That is like saying "you're both just suggesting two totally different designs for the HTTP security model".

His model is wrong. Again: I assume he wants to know that, so, bluntness.

[ Parent | on HN ]