Posted by Curtis on 01/17/07 02:03

On Jan 16, 12:36 pm, Michael Fesser <neti...@gmx.de> wrote:
> 2) The default request method for pages and other resources like images
> etc. is GET. This can be abused as well to fool the browser into sending
> a malicious request itself, see
>
> http://groups.google.com/group/comp.lang.php/msg/42c80631acf96223

Michael, that example you linked to (by Joshua Bell) was an intriguing
scenario - I had never thought about that before.

However, there is one way to mitigate that. The ?delete=[id] should
still force a logged in member to re-authenticate (displaying a POST
form). I think this should work, although I haven't implemented
something like this.

Thanks for the food for thought. :)

Curtis

[Back to original message]