Re: XSS issue

Courtenay
Thu, 18 Sep 2008 21:43:52 -0000

Yes, but it prevents a third-party site from doing something like this
(yes, a variation on this really happened)

<form action="http://twitter.com/statuses/" method="post"
id="hax">
  <input type="hidden" name="status[text]"
value="OMG hax!!" />

$(''hax'').submit();


On Thu, Sep 18, 2008 at 1:08 PM, pankaj <pankajbhageria@gmail.com>
wrote:
>
> To prevent XSS attack rails generates an authenticity_token for every
> form.
> This token has to be present in with every request other then
''ge''t.
> I have noticed that this token is same accross the application..i
> think for a particular session..
> This token can be extracted by javascript and a new create/update/
> delete request can be successfully executed.
> Then authentication_token is of no use.
> Correct me if I am wrong?
>
> Regards,
> Pankaj
> >