RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?
| From: | Saqib dot N dot Ali at seagate dot com | Date: | Tue, 17 Aug 2004 00:40:15 +0000 |
| Subject: | RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-194023@lists.php.net to get a copy of this message | ||
Thanks Curt, Chris and Ed,
It is indeed the disabling of third-party cookies that is causing this
behaviour in I.E. :)
So thanks all the help :)
Thanks.
Saqib Ali
http://validate.sf.net <<< XHTML/DocBook XML Validator
and Transformer
"Ed Lazor" <Ed.Lazor@d20News.com>
No Phone Info Available
08/16/2004 04:57 PM
To
<Saqib.N.Ali@seagate.com>, <php-general@zirzow.dyndns.org>
cc
<php-general@lists.php.net>
Subject
RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?
> -----Original Message-----
> However a CSRF attack is NOT trying to access a third party cookie.
>
> The web browser make the same GET request whether it is using <img/> TAG
> or the user clicking on a link. So in either case the cookies are in the
> context of the website to which the cookies belong.
I think Curt was correct actually. Hopefully the test I sent earlier can
confirm or at least cross-reference this.
-Ed
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php