Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.python > #81780

Re: Cherrypy - prevent browser "prefetch"?

Show key headers only | View raw

On 2014-12-01 22:44, Christoph M. Becker wrote:
> Tim Chase wrote:
> > haven't investigated recently, but I remember Django's ability to
> > trigger a log-out merely via a GET was something that irked me.
> > 
> > All this to also say that performing non-idempotent actions on a
> > GET request is just begging for trouble. ;-)
> 
> ACK.  However, isn't log-out an idempotent action?

A minor note here...the OP talked about CherryPy and I've been in
Django-land too long that I started talking Django.  I'd have
to pick open the scabs of my CherryPy experience to answer about CP.

But yes, it appears that Django's contrib.auth module still allows
for performing a logout/ on a GET (something I remember
encountering/researching several years ago) rather than limiting it to
a POST. As best I can tell, it doesn't even check the refer(r)er, so
this charmingly means that I can put a tag like

 <img src="http://yoursite.example.com/logout/"> 

on *my* site, and it will log you out from yoursite.example.com
despite.  Not even a CSRF-token check because it's not a POST.

-tkc

Back to comp.lang.python | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: Cherrypy - prevent browser "prefetch"? Tim Chase <python.list@tim.thechases.com> - 2014-12-01 15:26 -0600
  Re: Cherrypy - prevent browser "prefetch"? "Christoph M. Becker" <cmbecker69@arcor.de> - 2014-12-01 22:44 +0100
    Re: Cherrypy - prevent browser "prefetch"? Tim Chase <python.list@tim.thechases.com> - 2014-12-01 16:04 -0600

csiph-web