Re: [RFC DRAFT] Automatic CSRF Protection
| From: | Fleshgrinder | Date: | Tue, 10 May 2016 16:48:03 +0000 |
| Subject: | Re: [RFC DRAFT] Automatic CSRF Protection | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-93154@lists.php.net to get a copy of this message | ||
On 5/10/2016 5:24 AM, Yasuo Ohgaki wrote:
> Hi all,
>
> It's not nice to work on the same code (i.e. session module) for
> multiple RFCs, but time is limited.
>
> I would like to hear from ideas/comments before I write patch for this.
> https://wiki.php.net/rfc/automatic_csrf_protection
>
> Thank you for your comments.
>
> Regards,
>
> P.S. Precise session ID management is important, but this one is also
> important. I'll finish and start voting 2 active session RFCs soon. I
> may finish all of them hopefully.
>
-1 CSRF protection is a very specific need of some parts of a website
and not something that is universally required.
--
Richard "Fleshgrinder" Fussenegger
Attachment: [application/pgp-signature] OpenPGP digital signature signature.asc
Attachment: [application/pgp-signature] OpenPGP digital signature signature.asc