[nicolaslem]

Isn't that vulnerable to CSRF? What if a page linked on the front of HN makes a request collapsing every single comment?

[slg]

One of the top posts in the history of HN was a link that upvoted itself due to this issue.

[thepete2]

Yes, but you need a token to log out. For collapsing comments it should work though

[thepete2]

correction: same origin policy, so it doesn't work

[lol768]

SOP isn't relevant here - it relates generally to _reading_ content from another origin.

What is relevant here is whether the cookies are SameSite and/or whether a token is required.