Comment on Security patch releases to Rails 2.3.x, 3.0.xparentComments−bonzoesc15yIs there any reason to reset the session on a CSRF failure vs. just failing the request? Seems like you could have fun DOSing people from their sessions on other sites with that default behavior.−nbpoole15yThat's right. Of course, without knowing more details about the vulnerability, it's hard to say whether there's a benefit to ending the session.
Comments
Is there any reason to reset the session on a CSRF failure vs. just failing the request? Seems like you could have fun DOSing people from their sessions on other sites with that default behavior.
That's right. Of course, without knowing more details about the vulnerability, it's hard to say whether there's a benefit to ending the session.