You know how HTTP GET requests are meant to be idempotent?

Post by latchkey » Thu, May 03, 2018, 3:40 AM UTC

latchkey wrote: post #239

JimDabell wrote: post #128

Earlier quoted context omitted.

It still seems a bit odd to do it this way when it's so easy to do it right. I hope the hostnames / IP addresses aren't predictable, because all it would take to cause trouble is to send an HTML email containing something like " rel="nofollow">http://192.168.0.1/reboot"> to your staff and then you'd trigger a bunch of reboots whenever anybody opened their email. Or just send a link to a page that does the same thing.…

I feel like the 'do it right' comment is a bit speculative or entitled. It does create a usability barrier that I was trying to avoid. Even the extra button click is a pain in the ass when you're rebooting dozens of machines (sometimes daily). Your second paragraph is spot on. Very good point and kind of why I posted here in the first place. Two minds are always better than one. I forgot about the image attack. I've…

Post by MrMid » Sat, May 05, 2018, 9:03 AM UTC

dogma1138 wrote: post #70

MrMid wrote: post #58

Well, a while ago I saw this code (on my own project!): window.open("?controller=users&action=changePassword&name=" + user_name + "&password=" + password) I was horrified, glad it isn't live yet, and I fixed it immediately. But I'm still wondering whether I was so sleep-deprived or drunk when I wrote this. It's over SSL, so it should not be that big deal, but still, GET shouldn't be used for such things.

Well you don’t seem to validate the existing password prior to authorizing the change. Good CSRF protection on GET requests is also near impossible to implement as GET is intended to be a “safe” request as in a request that does not modify a state but this isn’t something that is actually practiced.