Comment on ShowHN: dweet.io – Twitter for machinesparentComments−sunir12yAnd I can put that delete URI in an <img src=""> and have your browser or iPhone email automatically destroy your document before you can stop it.−jheising12yYes and if I were a hacker, I could do the same thing with curl. Either way the only person who's likely to do it is someone who is technically savvy.−bluefinity12yYou can do the same thing with POST by submitting a form with JS. The correct way to protect against this sort of thing is to use a CSRF token.−oneeyedpigeon12ySubmitting a form with JS is a whole other level of complexity than just having a link out there in the wild that performs write operations. And using a CSRF defeats that stated intent.
Comments
And I can put that delete URI in an <img src=""> and have your browser or iPhone email automatically destroy your document before you can stop it.
Yes and if I were a hacker, I could do the same thing with curl. Either way the only person who's likely to do it is someone who is technically savvy.
You can do the same thing with POST by submitting a form with JS. The correct way to protect against this sort of thing is to use a CSRF token.
Submitting a form with JS is a whole other level of complexity than just having a link out there in the wild that performs write operations. And using a CSRF defeats that stated intent.