note 110898 deleted from book.hash by danbrown
| From: | danbrown@php.net | Date: | Thu, 17 Jan 2013 15:33:12 +0000 |
| Subject: | note 110898 deleted from book.hash by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-193158@lists.php.net to get a copy of this message | ||
Note Submitter: mandatory bat gmail pot con
----
Hashes are important to fix CSRF vulnerabilities - for example somebody could link to the upvote
arrow on this page and post a link to someplace like Reddit.
Example:
http://us2.php.net/manual/vote-note.php?id=XXXXX&page=function.hash-algos&vote=up
Then people would visit the link in their browser (or load it an in iFrame etc) and it would upvote
the link without their knowledge or consent.
If a has was generated for each viewer then you couldn't accomplish this ;)