search

dxprog / anime-bracket

The code that runs animebracket.com
http://animebracket.com
84 stars 20 forks source link

Change method to PUT #30

Closed Isopach closed 6 years ago

Isopach commented 6 years ago

Prevents CSRF and resolves #23

dxprog commented 6 years ago

Thanks for the PR, but this doesn't actually prevent any CSRF attacks because the backend will still respond to GET/POST requests from outside sources (the ones you actually care about). I think I'd prefer to go the path of using CSRF tokens, and the most important parts to hit will be the admin tools which I realize are wide open to attack right now.

Isopach commented 6 years ago

Ahh yes, using tokens would be a better way than this stopgap unless you disabled POST on the backend too. Let me know if I can help in any way.