Re:A modern approach to preventing CSRF in Go
by masklinn on Wednesday October 15, 2025 @04:34AM
(#45589629)
A CSRF is an attack against a logged in user, so has to be mediated via their browser.
If you can spoof the origin header of a second party when they navigate to a third party, a CSRF is a complete waste of whatever vulnerability you have found.
If you can spoof the origin header of a second party when they navigate to a third party, a CSRF is a complete waste of whatever vulnerability you have found.