turn /friends/follow into POST request

mastodon / mastodon-bridge

Moved to https://source.joinmastodon.org/mastodon/bridge

https://bridge.joinmastodon.org

62 stars 11 forks source link

Open jomo opened 7 years ago

jomo commented 7 years ago

Otherwise users could be forced to unwittingly follow users by embedding a follow link on a third party site.

For example embedding https://mastodon-bridge.herokuapp.com/friends/4512/follow as an image somewhere will cause you to follow me as soon as the page loads, without you knowing, when you're logged in to mastodon-bridge.

MattiJarvinen commented 6 years ago

If this is still true, this must be fixed.