Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
5
Impact
~129 people reached

  • 0 posts edited
  • 1 helpful flag
  • 13 votes cast
Dec
30
comment Are there security advantages gained from forcing a website to be available from just one tab at a time?
One of the reasons not mentioned yet might be overzealous CSRF protection (in practice you don't need a new token for each request to prevent CSRF, just a new token every time you log in, or change privileges level). But more likely it's related to the technology stack used as pointed by the two most upvoted answers.
Sep
29
awarded  Citizen Patrol
Sep
28
comment Why is the synchronizer token pattern preferred over the origin header check to prevent CSRF
On the other hand, for an existing application, the CSRF token way is backward-incompatible: all the clients would have to be updated, or they will instantly break the moment the server starts blocking the requests without token. It might be a stopper for certain scenarios (or, one could do a gradual roll-out: first implement the token exchange between the server and clients, but not enforce token validation on server only after high enough percentage of clients have been updated). By clients, I mean clients of the API; for instance, hybrid mobile apps.
Sep
24
revised Are there any severe concerns of sending the user's login and password with each HTTPS request?
edited tags
Sep
24
awarded  Student
Sep
24
awarded  Editor
Sep
24
revised Are there any severe concerns of sending the user's login and password with each HTTPS request?
edited title
Sep
24
asked Are there any severe concerns of sending the user's login and password with each HTTPS request?
Nov
17
awarded  Autobiographer
Sep
29
awarded  Supporter