Hacker News new | ask | show | jobs
by None4U 872 days ago
Perhaps HttpOnly wasn't as prevalent back then?
1 comments
matsemann 872 days ago
Yup, no CORS either, all protections relied on having proper CSRF-tokens, but with JS access one could read that token as well.

My "hack" was mostly pretty harmless. Just did some layout changes to make my profile cooler. But the door was wide open for anything.

link