RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?
| From: | Ed Lazor | Date: | Mon, 16 Aug 2004 23:57:50 +0000 |
| Subject: | RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-194015@lists.php.net to get a copy of this message | ||
> -----Original Message-----
> However a CSRF attack is NOT trying to access a third party cookie.
>
> The web browser make the same GET request whether it is using <img/> TAG
> or the user clicking on a link. So in either case the cookies are in the
> context of the website to which the cookies belong.
I think Curt was correct actually. Hopefully the test I sent earlier can
confirm or at least cross-reference this.
-Ed