News for hackers. Stuff that matters.

A comment on #1 CSRF Is A Vulnerability In All Browsers. Parent comment

Re:#1 CSRF Is A Vulnerability In All Browsers by mhansen on Saturday March 31, 2012 @02:05AM (#3779552)
That won't work without javascript, and then you need another URL to fallback to that'll respond to GET requests for non-javascript browsers. And then you could just XSRF the non-javascript URL.

[Disclaimer: I work at Google, but not on any area related to this]

[ Parent | on HN ]
Re:#1 CSRF Is A Vulnerability In All Browsers by simonw on Saturday March 31, 2012 @02:31AM (#3779597)
I don't understand why this would need JavaScript - regular CSRF protection for POST requests works fine without JavaScript - why can't that be applied to the logout button?
[ Parent | on HN ]