Comment on ShowHN: dweet.io – Twitter for machinesparentComments−bluefinity12yYou can do the same thing with POST by submitting a form with JS. The correct way to protect against this sort of thing is to use a CSRF token.−oneeyedpigeon12ySubmitting a form with JS is a whole other level of complexity than just having a link out there in the wild that performs write operations. And using a CSRF defeats that stated intent.
Comments
You can do the same thing with POST by submitting a form with JS. The correct way to protect against this sort of thing is to use a CSRF token.
Submitting a form with JS is a whole other level of complexity than just having a link out there in the wild that performs write operations. And using a CSRF defeats that stated intent.