a nonce/token isn't a defense against XSS... it isn't even a very good defense against CSRF, but the best we really know about ATM.<br><br><div class="gmail_quote">On Mon, May 5, 2008 at 5:41 PM, Jon Daley <<a href="mailto:plogworld@jon.limedaley.com">plogworld@jon.limedaley.com</a>> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="Ih2E3d">On Mon, 5 May 2008, Reto Hugi wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
But in most cases CSRF countermeasures become useless if you have XSS vulnerabilities (remember: XSS means code injection in your html, means possibility to grab nonces etc...)<br>
</blockquote></div>
Right, but if you don't even accept the POST in the first place, that it doesn't matter what the content is, no matter where it came from, right?<div><div></div><div class="Wj3C7c"><br>
_______________________________________________<br>
pLog-svn mailing list<br>
<a href="mailto:pLog-svn@devel.lifetype.net" target="_blank">pLog-svn@devel.lifetype.net</a><br>
<a href="http://limedaley.com/mailman/listinfo/plog-svn" target="_blank">http://limedaley.com/mailman/listinfo/plog-svn</a><br>
</div></div></blockquote></div><br>