Alright as soon as I get Situated on this train I'm gonna start asking a whole buncha questions about CSRF
-
Alright as soon as I get Situated on this train I'm gonna start asking a whole buncha questions about CSRF
-
Alright as soon as I get Situated on this train I'm gonna start asking a whole buncha questions about CSRF
@mcc byeeeee
-
@mcc byeeeee
@evan I enjoyed my stay in Montreal.
-
@mcc It was really great getting to hang out. We should have done a selfie together, though!
-
Alright as soon as I get Situated on this train I'm gonna start asking a whole buncha questions about CSRF
OK so
I got a web app
I want the endpoints at /actions , and only those endpoints, to reject/not-receive requests that are not same-origin. Other endpoints (regular html pages; oauth callback) SHOULD be possible to link/redirect to.
I'm reading: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#:~:text=for%20example%2C%20suppose%20web%20content
The 2 ways I can imagine doing this are:
- Check for Origin: header and reject request if wrong (will privacy plugins sometimes suppress this?)
- Send `Access-Control-Allow-Origin: https://me`, also use Post to force preflight -
undefined Oblomov shared this topic on