Re: CSRF attack not possible in I.E. 6.01 SP1?

* Thus wrote Saqib.N.Ali@seagate.com: > Hello Chris, > > I can't share the exact code ;) , but here is something very similar: > > <img src="http://slashdot.org/my/logout" > height="1" width="1"> > > If I load a web page with the above code, it should log me out of > slashdot. It works in Mozilla (and netscape), but not in I.E. 6.01 SP1 I'm not sure how the /. logout system works, but my guess is that they rely on cookies to do this. Since that is a different site than from the originating file, those cookies would be considered third party. I know in IE you can disable third party cookie access. Curt -- First, let me assure you that this is not one of those shady pyramid schemes you've been hearing about. No, sir. Our model is the trapezoid!