Re:CSRF: Cross-Site Request Forgeries
by jamessocol on Thursday July 19, 2012 @11:18AM
(#4266383)
> In order to issue a POST request to siteA from the evil page, the attacker only has to submit a crafted POST form using an iframe.
Yes, but requiring POST for anything that changes anything (especially bank transfers) is a best practice anyway, for how all actors involved understand HTTP verbs, and reduces the surface area of attack.
Yes, but requiring POST for anything that changes anything (especially bank transfers) is a best practice anyway, for how all actors involved understand HTTP verbs, and reduces the surface area of attack.
You can create a POST with an iframe, but you can create a GET with an image tag: `<img src="http://mybank.com/transfer?...>`