News for hackers. Stuff that matters.

A comment on Why do we have both CSRF protection and CORS?. Parent comment

Re:Why do we have both CSRF protection and CORS? by chuckadams on Monday March 03, 2025 @08:20AM (#43241451)
A nonce, kept in an extra query parameter named "state". https://stackoverflow.com/a/77029859 has some of the gory details (myself, I just hash the session's CSRF token to generate a state token)
[ Parent | on HN ]

There are no comments on this comment yet.