Re: [RFC DRAFT] Automatic CSRF Protection
| From: | Stanislav Malyshev | Date: | Tue, 10 May 2016 23:01:12 +0000 |
| Subject: | Re: [RFC DRAFT] Automatic CSRF Protection | ||
| References: | 1 2 3 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-93180@lists.php.net to get a copy of this message | ||
Hi!
> Did you read RFC?
> It does not enable CSRF protection for all website, but only when it is enabled.
The RFC says: "Default: session.csrf_protection=1". Which means all
sites would have it (for POST) unless they specifically disable it by
changing configuration.
Also, new variants do not account for existence of other HTTP methods
such as PUT, DELETE, etc. Value "2" also makes little sense - why would
you want to protect GET, but not POST?
--
Stas Malyshev
smalyshev@gmail.com