Aristotle Pagaltzis wrote: > <img src="http://yourapp.example.org/addressbook/delete/all";> > > into a page they control and then send a link to that page to > your users. If you allow destructive actions on GET, you have > just allowed for your users to be screwed over through no fault > of their own.
Note that using POST rather than GET doesn't protect you from this specific problem - it's still possible to form a CSRF request with a POST action. Carl _______________________________________________ List: [email protected] Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst Searchable archive: http://www.mail-archive.com/[email protected]/ Dev site: http://dev.catalyst.perl.org/
