Re: CSRF attack not possible in I.E. 6.01 SP1?
| From: | Chris Shiflett | Date: | Mon, 16 Aug 2004 21:27:56 +0000 |
| Subject: | Re: CSRF attack not possible in I.E. 6.01 SP1? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-194008@lists.php.net to get a copy of this message | ||
--- Curt Zirzow <php-general@zirzow.dyndns.org> wrote:
> I'm not sure how the /. logout system works, but my guess is
> that they rely on cookies to do this. Since that is a different
> site than from the originating file, those cookies would be
> considered third party. I know in IE you can disable third
> party cookie access.
Good call, Curt. :-)
You can disable this in other Web clients as well, but I don't think it's
the default behavior for anything. Perhaps this particular version of IE
does not send cookies in requests for embedded resources? This does seem
like a plus.
Chris
=====
Chris Shiflett - http://shiflett.org/
PHP Security - O'Reilly
Coming Fall 2004
HTTP Developer's Handbook - Sams
http://httphandbook.org/
PHP Community Site
http://phpcommunity.org/