Don’t Click The WTF Link On Twitter Unless You Do Like Sex With Goats

Post by frognibble » Sun, Sep 26, 2010, 7:52 PM UTC

Groxx wrote: post #10

harryh wrote: post #8

Earlier quoted context omitted.

The fact that they're using a GET is not the problem (though it is slightly bad). The malicious javascript would have to be only slightly more complex if it was a POST. The issue is that there is no security token required when making the request to do the status update.

No, it's entirely the fault of GET. They're opening an iframe on their page with a source your post URL. If it were POST-only, they'd be blocked by Javascript being unable to communicate across domains.

Post by frognibble » Sun, Sep 26, 2010, 8:09 PM UTC

Groxx wrote: post #12

frognibble wrote: post #11

Earlier quoted context omitted.

No, it's not entirely the fault of GET. The browser does not prevent script from triggering POSTs to third party sites.

Seriously? Seems like a security problem waiting to happen... gotta give this a try now.

Post by sprout » Sun, Sep 26, 2010, 11:55 PM UTC

Post by [deleted] » Mon, Sep 27, 2010, 2:18 AM UTC

Groxx wrote: post #14

frognibble wrote: post #13

Earlier quoted context omitted.

Seriously. Search the web for documents on "cross site request forgery". Most of the documents discuss the POST issue. Some documents don't mention GET because GET should not be used when the request has side effects.

Oooh, I see how it's done now. Guess that makes sense, though it's still strange that browsers allow cross-domain form submissions...