[kentonv]

Sandstorm mitigates most CSRF in apps by hosting each grain session on a randomly-generated subdomain. That is, every time a user opens an app instance, they talk to it on a new unguessable subdomain.

Granted, a network-level attacker who can sniff the victim's DNS resolutions could discover the hostname and launch a CSRF attack. But, that's a much, much higher barrier than normal. (And the app's own internal CSRF protection still applies.)

(We're also working on some other tricks to mitigate CSRF for defense-in-depth, e.g. relying on Chrome's use of the "Origin" header, though there are currently some issues blocking rolling this out.)

I think you would find Sandstorm interesting.

Here's more documentation on our security model: https://docs.sandstorm.io/en/latest/using/security-practices...

And more generally Sandstorm's fine-grained containerization model, which among other things mitigates many app vulnerabilities: https://sandstorm.io/how-it-works

And here's a list of actual known app vulnerabilities we've mitigated through our model (before we knew about them): https://docs.sandstorm.io/en/latest/using/security-non-event...

[kevinr]

URLs aren't normally considered sensitive by users.

"Hey Carol, can you send me the link you're using to the wiki? Mine isn't working."

[kentonv]

The users don't actually see the session hosts since they're in an iframe.