News for hackers. Stuff that matters.

A comment on A proposal to restrict sites from accessing a users' local network. Parent comment

Re:A proposal to restrict sites from accessing a users' loca... by asmor on Thursday June 05, 2025 @06:04PM (#44196203)
If you're going cross-domain with XHR, I'd hope you're mostly sending json request bodies and not forms.

Though to be fair, a lot of web frameworks have methods to bind named inputs that allow either.

[ Parent | on HN ]
Re:A proposal to restrict sites from accessing a users' loca... by bawolff on Friday June 06, 2025 @03:20AM (#44198552)
This misses the point a bit. CSRF usually applies to people who want only same domain requests and dont realize that cross domain is an option for the attacker.

In the modern web its much less of an issue due to samesite cookies being default .

[ Parent | on HN ]