On Thu, Jan 15, 2009 at 7:24 AM, Bil Corry <b...@corry.biz> wrote: > Using XSS, an attacker could change the target of a login form to a MitM site,
If your site has XSS, there is nothing a CSRF defense can do to help you. On Wed, Jan 14, 2009 at 10:47 PM, Maciej Stachowiak <m...@apple.com> wrote: > So one thing to keep in mind is that any POST-based form would not be > vulnerable to this kind of attack unless the victim site actually submits a > form to an untrusted site. There is no way for a GET request to be > redirected to a POST, and it seems to me the practice of Site A submitting a > form to untrusted site B is likely to be quite rare and easily avoidable. I agree that POST-based redirects attacks on the Origin-header-as-CSRF-defense are mostly theoretical. Keep in mind also that even if the honest site sends a POST request to the attacker's site, the attacker is unable to alter the body of the request when redirecting it. > Thus, the difference in behavior of the CSRF-prevention Origin does not do > any good, and so we may as well use just one Origin header. I agree. Adam
