Timeline for How does a CSRF token prevent an attack, and how can I safely use/avoid it for my JSON API?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 21, 2018 at 1:54 | comment | added | Vitaly Osipov | @Dan2552 The malicious Flash plugin from site B cannot read cookies (or anything really, IIRC) from the site A. Same-origin policy prevents that, as have already been noted. It's good to have a questioning mind, but remember that topics like this have been researched to death over the past 10+ years ;) | |
| Dec 24, 2012 at 21:01 | comment | added | SLaks | @Dan2552: It can't. That's what the Same-Origin Policy is. | |
| Dec 23, 2012 at 1:39 | vote | accept | Dan2552 | ||
| Dec 23, 2012 at 1:38 | comment | added | Dan2552 | Thanks for your response. Regarding Q1 (I apologise of my lack of knowledge of web client-side capabilities, I know pretty much nil), if a malicious Flash content can send off a POST request, surely it has the capability of a response handler? If not, fair enough; but if it does, what's there to stop it grabbing the token there? | |
| Dec 23, 2012 at 1:13 | history | answered | Vitaly Osipov | CC BY-SA 3.0 |