1

This question already has an answer here:

I understand that best practice is to use tokens to prevent CSRF, but why do browsers permit cross-site POST requests in the first place? It seems like giving untrusted parties unfettered write access to your server is a bad idea.

The W3's site says that "Under the same-origin policy, cross-site sending of information is also dangerous since it enables attacks such as cross-site request forgery (CSRF) and clickjacking. The same-origin policy cannot address these security vulnerabilities in the same way it does those around receiving of information since prohibiting cross-site sending of information would prohibit cross-site hyperlinks." [1]

But this seems like a false dichotomy. We could disallow cross-site POSTs while still allowing hyperlinks, which are GETs.

[1] https://www.w3.org/Security/wiki/Same_Origin_Policy

marked as duplicate by Steffen Ullrich, AndrolGenhald, Xander, forest, Community Jun 12 '18 at 15:09

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • What is "unfettered write access"? – curiousguy Jun 11 '18 at 17:50
  • @curiousguy the ability to make POST requests on the user's behalf – Michael Gummelt Sep 30 at 18:18
0

It seems like giving untrusted parties unfettered write access to your server is a bad idea.

I guess that would be true unless your entire business model depended on it:

  • These servers could opt-in to cross-origin POSTs, much like they do with the Access-Control-Allow-Origin header – Michael Gummelt Sep 30 at 18:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.