I partly disagree with Anders on
But that is not how the internet was built back in the day, and there
is no way to change it now.
The developers of major browsers do have pretty much power to change the Internet and guide web developers to the direction they want. Obsoleting cross-site POST data would be possible, if it was seen as a major threat. There's examples of such progress on other things, although it's not sudden nor fast:
Flash. While it was formerly seen as the future of the web, major browsers have announced not to support it in the future, and web developers are adjusting.
HTTPS has been slowly forced by the browsers, with small steps towards warning about plain HTTP being insecure. We may eventually see a world where plain HTTP is slowly suffocated to death.
I'd like to see this to develop towards prioritizing security over compatibility more widely. Naturally, such a big change would not be something to do over-nigh, but by giving alternatives and discouraging it first. The path to achieve this could be like this:
- Introducing a Same-Origin Policy header for
POST requests, that allows explicit consent.
- Starting to show warning of possible security problem on cross-site
POST without the consent.
- Sites still needing this functionality starts slowly to adapt, to get rid of the warning.
- After a long transitional period the action could be changed to be more rough.
POST on plain HTTP is quite close to discouraging cross-site
POST, both being against the standards. This is just conscious loss of backward compatibility, for increasing security.