Hacker News new | ask | show | jobs
by reza_n 2978 days ago
To me this sounds like a CSRF problem. There's no token or session associated with these calls, so a browser was able to inadvertently CSRF the calls. Changing this call to POST or PUT would still leave this API vulnerable.
1 comments
chrisseaton 2978 days ago
It's not about access control, it's about the fact that browsers are free to make speculative GET requests whenever they like, and they actively do to pre-fetch pages. His GET end-point was pre-fetched by his browser, activating the door. This would still happen even if there was a token or session associated.
link
reza_n 2978 days ago
> This would still happen even if there was a token or session associated.

This is exactly the scenario a CSRF token is support to prevent. But I understand your point.

link
jimktrains2 2978 days ago
Not just browsers, but any service.
link