csrf

相关标签：javascript jquery android 多少钱 iPhone

Is comparing a session value and a hidden form enough to prevent CSRF?

So the \"typical\" CSRF protection method is storing a nonce in a session and in a hidden form element. Is it possible for an att开发者_如何学JAVAacking website to first scrape the target form using t[详细]

2023-03-12 14:49 分类：问答
Why I should not return a json list as result in web service?

I did try to开发者_开发百科 return a data list as result in my web application. For example @expose(\'json\')[详细]

2023-03-12 11:26 分类：问答
Session handling during login with protection against XSRF (cross-site-request-forgery) in GWT

I have implemented a simple GWT application featuring a login service (LoginService) and a worker service (WorkerService). Both GWT-RPC. I have protected all services against XSRF by implementing GWT\[详细]

2023-03-12 07:43 分类：问答
Caching login forms with Ruby on Rails

I have a Rails 3 开发者_运维百科website, for which the home page is static content plus a login form. I want to use HTTP caching on this page (we’re on Heroku - behind Varnish), but then the login fo[详细]

2023-03-11 02:43 分类：问答
Symfony: secure delete link with CSRFProtection

I have a delete link to delete a Comment object by ID /comment/:id/delete In order to secure this link I add a csrf token to the link[详细]

2023-03-11 00:22 分类：问答
Can jsonp be protected with a csrf token?

Use case: In a same-domain situation, I want to use jsonp for data transport, simply because it happens earlier in the request than any ajax or iframe transport. Also, I want this data to be cached li[详细]

2023-03-10 10:01 分类：问答
CSRF protection with javascript?

Can i protect from 开发者_运维百科CSRF by generating csrf token clien-side with javascript and setting from javascript cookie with this token and adding this token to post request?[详细]

2023-03-10 04:43 分类：问答
Images with BBcode (php, preg_replace). Security question

Bbcode question. This开发者_开发百科: $text = preg_replace(\"@\\[img\\](.*)\\[\\/img\\]@si\", \"<img src=\\\"$1\\\" border=\\\"0\\\" />\", $text);[详细]

2023-03-10 03:19 分类：问答
GWT - Dealing with XSRF/CSRF

Am I correct, that if I pass a self-generated sessionID with every RPC request, and only check this sessionID instead of the one passed 开发者_高级运维in the cookie header, the session can\'t be hijac[详细]

2023-03-08 01:24 分类：问答
Why is my user's X-CSRF-Token header different form the _csrf_token in the session?

For a very small number of users (who are making legitimate requests) on my site, the X-CSRF-Token header sent with their AJAX requests is different from the _csrf_token in the开发者_如何学Goir (cooki[详细]

2023-03-07 16:15 分类：问答