CSRF attack not possible in I.E. 6.01 SP1?
| From: | Saqib dot N dot Ali at seagate dot com | Date: | Mon, 16 Aug 2004 17:41:01 +0000 |
| Subject: | CSRF attack not possible in I.E. 6.01 SP1? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-193972@lists.php.net to get a copy of this message | ||
Hello All,
I am working on securing an application that uses CDSSO (Cross Domain
Single Sign On).
I am trying to reproduce the CSRF (Cross Site Request Forgery) attack
(using <img/> TAG) in I.E. 6.01, but am unable to do so. However the
attack works on Mozilla and other older browsers.
My question: Is I.E. 6.01 SP1 doing something to foil the CSRF attack,
i.e. only allow image extensions .gif .png .jpeg?????
Regards,
Saqib Ali
http://validate.sf.net <<< DocBook XML -> XHTML /
PDF Convertor