Re: CSRF Protection Bypass in Ruby on Rails - I don''t get it ...

Michael Pavling
Wed, 09 Feb 2011 21:29:19 -0000

On 9 February 2011 21:25, Xavier Noria
<fxn-xlncskNFVEJBDgjK7y7TUQ@public.gmane.org>
wrote:
> Few people but Koz have the details of the exploit, that''s why I
> suggested to ask in -core. And as I suspected the announce is vague on
> purpose.

He''s just posted a reply to the question on core saying exactly that.

I did laugh out loud at his final comment:

On 9 February 2011 21:06, Michael Koziarski
<michael-om4Kh3VVhE6tG0bUXCXiUA@public.gmane.org>
wrote:
> If you have API requests which *do* rely on the session, then
you''re
> fucked as that''s a CSRF request by definition.

:-D