Geek Answers Handbook

Do I need an anonymous csrf comment / mailbox? If not, why does SO use it and how to implement it?

It discusses how this is on SO, arguing that csrf protection is not required for anonymous forms. Looking at the stackoverflow HTML code, if you are not logged in, you can see the csrf token if sent to an anonymous user.

  • How does this csrf token help protect an anonymous user?
  • The csrf character must be associated with a user session identifier. What equivalent is used for an anonymous user? IP address?
+4
source share
2 answers

How does this csrf token help protect an anonymous user?

, CSRF. , - , . , , CSRF (, ). , . CSRF ( ).

, CSRF. , , JavaScript , CSRF. , , .

csrf . ? IP-?

- . , PHP $_ SESSION. cookie . CSRF.

+1

.

csrf ?

, . (IP-, , , cookie ..), . , CSRF, , Origin referer.

csrf . , ? IP-?

, CSRF. Double Submit Cookies.

, :

  • HTTP- HTML- Set-Cookie: , .
  • , cookie, , .

"" , , cookie , (.. , ).

+1

More articles:


All Articles