[whatwg] CSRFs and Origin header and <form>s
ian at hixie.ch
Sat Nov 29 22:20:05 PST 2008
On Sat, 29 Nov 2008, Adam Barth wrote:
> On Sat, Nov 29, 2008 at 8:13 PM, Ian Hickson <ian at hixie.ch> wrote:
> > On Wed, 9 Jul 2008, Jonas Sicking wrote:
> >> This way servers could be configured to reject all POST requests that
> >> have an Origin header from a different site.
> > I'm all in favour of doing this, but isn't this something that belongs
> > in the HTTP spec rather than HTML5?
> I've taken the liberty of writing up a mini-spec for the proposal:
> I'm not sure if the HTTP spec is the most appropriate place because the
> spec has a dependency on HTML 5 to compute the ASCII serialization of
> the origin.
Well I don't mind putting it in HTML5 if that's where it has to be. Might
be worth asking the HTTP WG for advice though.
Regarding the open issue -- it seems like whenever a cross-origin redirect
takes place, the origin of the redirecting site should be used, instead of
the original origin. (But the origin should survive same-origin redirects
That would reduce the attack surface area to just the case of a hostile
site finding a redirect on a site trusted by the victim that redirects to
a victim site. Not sure if there's anything we can do about that case.
Ian Hickson U+1047E )\._.,--....,'``. fL
http://ln.hixie.ch/ U+263A /, _.. \ _\ ;`._ ,.
Things that are impossible just take longer. `._.-(,_..'--(,_..'`-.;.'
More information about the whatwg