News for hackers. Stuff that matters.

A comment on #1 CSRF Is A Vulnerability In All Browsers. Parent comment

Re:#1 CSRF Is A Vulnerability In All Browsers by tomjen3 on Saturday March 31, 2012 @03:30AM (#3779696)
I would like to know one thing.

Who the hell thought it was a good idea to allow crossdomain XmlHttpRequests? Given that the standard say that post is for modification no other website should ever make thoes requsts.

[ Parent | on HN ]
Re:#1 CSRF Is A Vulnerability In All Browsers by nbpoole on Saturday March 31, 2012 @09:37AM (#3780268)
The CORS standard for 'simple' POSTs is no different than what you can already submit via a form from a technological perspective. In that way, it actually makes a lot of sense.

And the whole point of CORS is that some websites do want to make those requests. ;-)

[ Parent | on HN ]