News for hackers. Stuff that matters.

A comment on ShowHN: dweet.io – Twitter for machines. Parent comment

Re:ShowHN: dweet.io – Twitter for machines by bluefinity on Saturday February 08, 2014 @01:28AM (#7200495)
You can do the same thing with POST by submitting a form with JS. The correct way to protect against this sort of thing is to use a CSRF token.
[ Parent | on HN ]
Re:ShowHN: dweet.io – Twitter for machines by oneeyedpigeon on Saturday February 08, 2014 @05:34AM (#7200872)
Submitting a form with JS is a whole other level of complexity than just having a link out there in the wild that performs write operations. And using a CSRF defeats that stated intent.
[ Parent | on HN ]