Sure it is. The same-origin rule that holds the whole web security model togethe... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

tptacek 8 months ago | parent | context | favorite | on: CSRF protection without tokens or hidden form fiel...

Sure it is. The same-origin rule that holds the whole web security model together is entirely a property of browser behavior.

louiskottmann 8 months ago [–]

That's indeed a good example of prior full trusting of the browser by the server.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact