What is 'Content-type: Preventing XSRF in IE' for?

Feeds produced by Google contain a strange comment:

<!-- Content-type: Prevent开发者_如何学JAVAing XSRF in IE. -->

For example, you can see it near the top of this feed. Can anyone explain the purpose of that comment?

---

It seems benhoyt on hacker news asked and answered this question.

I've just been tightening up our upcoming microPledge website -- http://micropledge.com -- to prevent cross-site request forgery (CSRF). I added a random SHA as a form key to each form. But! Then I discovered this lovely IE security hole. An attacker can use cross-domain JavaScript and an mhtml: redirect to grab the page, get the form key, and then do the POST. Brilliant! Anyone have any experience in getting around this?

...

IE parses the first part of an MHTML document as HTTP-style headers, so if you have an HTML comment at the start of your pages with "Content-Type: Something crazy" followed by a blank line, that fixes it.

---

XSRF (sometimes CSRF) is Cross-site Request Forgery: read more