note 87480 deleted from security.variables by danbrown

Note Submitter: SneakyWho_am_i ---- @f dot zijlstra: Actually the shared secret is a very good way to prevent many kinds of cross site request forgery and such. If your site accepts HTTP GET submissions for actions that change things on the server, and doesn't have a shared secret, then I can combine these two vulnerabilities to modify your logged in users's accounts just by showing them images or iframes. By using tinyurl I can completely conceal the attack in source code. NoScript won't protect your users from this kind of attack. With the "easysecure" thing, the unique id is stored as a session variable and therefore only sent to the one user. How am I going to obtain it? Why, I'll need a copy of the document that you sent only to your user. This would require some cache trick or a man-in-the-middle attack. Even if I somehow got the unique ID (which only you and your client know) I'd then need to hijack the client's session to use it. Basically there's no way that I can create a fake copy of the form, no way that you will accept data that I generate for my victim to send. It is a good way to prevent me from tricking your users into sending arbitrary data and making changes to their accounts.