Security advisory: Breach and Django

Re:Security advisory: Breach and Django by z-factor on Tuesday August 06, 2013 @12:01PM (#6167340)

I understand how the attack works, the question was about how a practical exploit would actually be carried out. I've figured out how one would issue GET requests from the right environment, but I don't know if the same is possible for POST.

[ Parent | on HN ]

Re:Security advisory: Breach and Django by wglb on Tuesday August 06, 2013 @12:15PM (#6167425)

It is just as possible. POST csrf exploits add between two and three minutes to an attacker to craft the request differently.

[ Parent | on HN ]

Re:Security advisory: Breach and Django by tptacek on Tuesday August 06, 2013 @12:38PM (#6167580)

Just in case you weren't clear on this already: CSRF works just fine against POST endpoints. Think Javascript.

[ Parent | on HN ]