Re:Post mortem of a failed HackerNews launch
by alexbrand09 on Thursday November 29, 2012 @10:10PM
(#4851637)
How would you circumvent this? I'm thinking that disabling CSRF is probably a bad idea. Maybe use AJAX to get the CSRF token after page load?
[ Parent
| on HN ]
Re:Post mortem of a failed HackerNews launch
by digitalpbk on Thursday November 29, 2012 @10:34PM
(#4851698)
Developer here, since we had a click to open form at the time, we loaded the CSRF via AJAX. However that does not seem to be a good idea if we need it to work asap (and without javascript). I would look at something like SSI to put in the CSRF token to a cached page.