Re: IE cookie menagment and CSRF

[Finite <wiretapped () gmail com>]

On Sat, 21 Aug 2004 22:10:10 +0200, lazy <lazy () gwsh gda pl> wrote:
> So if this schema is widly used it is a flaw in web page if it accept
> important data as GET requests

Actions executed by GET requests just need to verify the referrer as
well as the session cookie. Some users (mostly running opera) have
disabled the sending of referrers, so if you want to accommodate them
you'll need to use POSTs. Trusting GET requests without checking
referrers is a recipe for disaster; google for friendster or orkut and
"xss" to read stories about how to write shoddy web apps.