That won't work without javascript, and then you need another URL to fallback to... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

mhansen on March 31, 2012 | parent | context | favorite | on: #1 CSRF Is A Vulnerability In All Browsers

That won't work without javascript, and then you need another URL to fallback to that'll respond to GET requests for non-javascript browsers. And then you could just XSRF the non-javascript URL.

[Disclaimer: I work at Google, but not on any area related to this]

simonw on March 31, 2012 [–]

I don't understand why this would need JavaScript - regular CSRF protection for POST requests works fine without JavaScript - why can't that be applied to the logout button?

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact