Re:HTTP Security headers you should be using
by simonw on Thursday January 23, 2014 @01:31PM
(#7110061)
Loads of people thought it was a good idea. Traditional CSRF attacks work by pointing an HTML form on an evil third party site at an endpoint on the trusted site. HTML forms can't include custom HTTP headers, and you can't make Ajax requests (which can have custom headers) to different domains due to the same-origin policy - so the presence of an X-Requested-With header should be enough to "prove" that the request came from the same domain as you and not from a site run by an attacker.
Unfortunately certain versions of the Flash and JavaScript plugins allow requests to be made to other domains with custom headers, which left CSRF holes open.
Re:HTTP Security headers you should be using
by michaelmior on Thursday January 23, 2014 @02:34PM
(#7110580)
What do you mean by "JavaScript plugin"?
Re:HTTP Security headers you should be using
by richbradshaw on Thursday January 23, 2014 @04:08PM
(#7111206)
Think it's a typo for Java.
Re:HTTP Security headers you should be using
by michaelmior on Thursday January 23, 2014 @04:15PM
(#7111246)
Ah, that makes sense! Been such a long time since I've run a Java applet that I don't think about them anymore.
By who? Who thought the mere presence of an arbitrary header made the request "safe"?
Seriously, who the fuck thought this was a good idea? I have so far seen one single use for X-Requested-With - returning a page as "content only" - i.e. omitting the header, nav, footers etc for XHR calls.