Re:American Chemical Society bans university after "spider-t...
by dsl on Friday April 04, 2014 @09:54AM
(#7531380)
That isn't true. http://blog.codinghorror.com/preventing-csrf-and-xsrf-attack...
[ Parent
| on HN ]
Re:American Chemical Society bans university after "spider-t...
by tghw on Friday April 04, 2014 @10:41AM
(#7531659)
You're assuming the creator of the spider trap also put in CSRF protections. However, if you read the article, you'll see that it is only a link, with no CSRF protection at all. Therefore, it is quite true that spamming research mailing lists could lock a lot of people out. In fact, since this spider trap is triggered on a GET request, you would just need to embed the link as an image, script, or stylesheet and get the target to visit a page.