ShowHN: dweet.io – Twitter for machines

Re:ShowHN: dweet.io – Twitter for machines by sunir on Friday February 07, 2014 @08:02PM (#7199835)

And I can put that delete URI in an <img src=""> and have your browser or iPhone email automatically destroy your document before you can stop it.

[ Parent | on HN ]

Re:ShowHN: dweet.io – Twitter for machines by jheising on Saturday February 08, 2014 @11:42AM (#7201635)

Yes and if I were a hacker, I could do the same thing with curl. Either way the only person who's likely to do it is someone who is technically savvy.

[ Parent | on HN ]

Re:ShowHN: dweet.io – Twitter for machines by bluefinity on Saturday February 08, 2014 @01:28AM (#7200495)

You can do the same thing with POST by submitting a form with JS. The correct way to protect against this sort of thing is to use a CSRF token.

[ Parent | on HN ]

Re:ShowHN: dweet.io – Twitter for machines by oneeyedpigeon on Saturday February 08, 2014 @05:34AM (#7200872)

Submitting a form with JS is a whole other level of complexity than just having a link out there in the wild that performs write operations. And using a CSRF defeats that stated intent.

[ Parent | on HN ]