Re: Cross Site Request Forgery and GET (ACTION-274)

> In that circumstance, a "log out to prevent XSRF" practice just 
> doesn't make sense.

Well, it does if the collection of applications/sites you have active 
includes at most one in which you have login credentials giving permission 
to access or change sensitive information.  For myself, I try to maintain 
that self-imposed restriction, and it would be easier and safer if my user 
agent helped me to do that.  I'm not saying that this is a complete 
solution, but maybe a piece of the puzzle.  For example, if the user agent 
were aware of such logins being active, it could warn when a script from 
another site was taking advantage of them.

Noah

--------------------------------------
Noah Mendelsohn 
IBM Corporation
One Rogers Street
Cambridge, MA 02142
1-617-693-4036
--------------------------------------








Thomas Roessler <tlr@w3.org>
06/05/2009 09:56 AM
 
        To:     noah_mendelsohn@us.ibm.com
        cc:     www-tag@w3.org
        Subject:        Re: Cross Site Request Forgery and GET 
(ACTION-274)


On 5 Jun 2009, at 00:36, noah_mendelsohn@us.ibm.com wrote:

> Granting that naive users won't know to do this, and even 
> sophisticated
> users can easily forget: to what extent can individuals protect 
> themselves
> by logging off from one site before visiting another.

In theory, that would help (though there are some tricks to cause 
logins when form fillers are active).

The real point here is, though, that today's web browsers will run 
several web applications at the same time; these applications might 
come from different origins, depend on each other, and talk to each 
other.

In that circumstance, a "log out to prevent XSRF" practice just 
doesn't make sense.

Received on Friday, 5 June 2009 14:06:47 UTC