New answers tagged csrf
0
Your scenario is based on a misunderstanding, namely that its possible for badsite to initiate a get request to goodbank using the clients session (to obtain a html response containing a token).
The blog post linked in the question shows a way to use (the now defunct) Yahoo QL service as a proxy, it only looks like they are making a direct request due to ...
1
In short, it's because websites can send data by making POST request to other websites, but they cannot read data from other websites.
Let's forget about CORS (a way to explicitly allow sharing data between different domains anyway), and let's say A and B are two unrelated websites. A can make a POST request to B, sending data and performing actions. But A ...
Top 50 recent answers are included
