Re: [access-control] Access-Control-Allow-Origin: * and ascii-origin in IE8

On Thu, Jan 15, 2009 at 7:24 AM, Bil Corry <bil@corry.biz> wrote:
> Using XSS, an attacker could change the target of a login form to a MitM site,

If your site has XSS, there is nothing a CSRF defense can do to help you.

On Wed, Jan 14, 2009 at 10:47 PM, Maciej Stachowiak <mjs@apple.com> wrote:
> So one thing to keep in mind is that any POST-based form would not be
> vulnerable to this kind of attack unless the victim site actually submits a
> form to an untrusted site. There is no way for a GET request to be
> redirected to a POST, and it seems to me the practice of Site A submitting a
> form to untrusted site B is likely to be quite rare and easily avoidable.

I agree that POST-based redirects attacks on the
Origin-header-as-CSRF-defense are mostly theoretical.  Keep in mind
also that even if the honest site sends a POST request to the
attacker's site, the attacker is unable to alter the body of the
request when redirecting it.

> Thus, the difference in behavior of the CSRF-prevention Origin does not do
> any good, and so we may as well use just one Origin header.

I agree.

Adam