Browser bugs that steal content off other pages -- is that why oftentimes the session id is not used as the secret in side-effecting requests? I've seen a lot of sites use random unique secrets and wondered why they didn't just use the session id.
You're right :) But I don't see how that can be done if the front page is cached, so therefore the same ID is assigned to many people. I haven't researched session cookies yet to know if that can solve the problem.
Comments
GET and POST have nothing to do with it. You could have written this hack just as easily (or nearly as easily) if POST were required.
To fix the problem, PG needs to check that the userid that clicked the fnid is the same as the userid for which it was created.
BTW, browser bugs actually make the problem even more complex than this because it is sometimes possible to steal content off of other pages.
Browser bugs that steal content off other pages -- is that why oftentimes the session id is not used as the secret in side-effecting requests? I've seen a lot of sites use random unique secrets and wondered why they didn't just use the session id.
You're right :) But I don't see how that can be done if the front page is cached, so therefore the same ID is assigned to many people. I haven't researched session cookies yet to know if that can solve the problem.