Hacker News new | ask | show | jobs
by Groxx 5739 days ago
Oooh, I see how it's done now. Guess that makes sense, though it's still strange that browsers allow cross-domain form submissions...
1 comments

If browsers didn't support cross-site form submission, many common "web gadgets" wouldn't work: there would be no site-customized Google search boxes, and none of those third-party "share this page" buttons. Sure, the merit of those things is itself debatable—but they exist, and web developers will increasingly rely on them (e.g. the Facebook Like button.)

Also, sure, every webserver could proxy the requests—but then you have to guarantee that you haven't created an open proxy, which is a much worse hole than a simple CSRF—and then you have to do some more server-side configuration every time you want to enable your views to touch a new third-party API—which excludes a lot of hosted sites, like blogs, from using any API that their server admin hasn't considered.