= 27d567bc2d48d9f40e9ccc20ea370b15)
whpearson comments on Positive Bias Test (C++ program) - Less Wrong
You are viewing a comment permalink. View the original post to see all comments and the full post content.
= 783df68a0f980790206b9ea87794c5b6)
Loading…= b715d02e85f7b3b4ae65ca3d3e450868)
Subscribe to RSS Feed
Powered by Reddit
= f037147d6e6c911a85753b9abdedda8d)
You are viewing a comment permalink. View the original post to see all comments and the full post content.
Comments (75)
You can still have XSRF attacks without javascript though... so they are not caused by javascript but facilitated. Harder but doable, and you might protect yourself from some in the wild by turning off javascript.
Reading up about this a bit more it does appear that noscript does help against XSRF even those that don't use javascript, by changing post requests from untrusted sites to empty gets.
More details can be found on the noscript developers blog,
Editted: Made correction suggested by child post of JGWeismann,
Neat. Though I think you meant "changing post requests from untrusted sites to trusted sites to empty gets", as would be expected to protect against Cross Site Forgery.