[wp-hackers] Any other way to do it? (or, do we really need Nonces?)

[Elliotte Harold]

Peter Westwood wrote:

> How does switching to POST over GET remove the possibility of security 
> holes?  They are both just as exploitable from a security point of view 
> if they are not given protection.

GET is supposed to be a safe operation. Users are supposed to be able to 
follow links without worrying about doing things. In WP, they can't. 
This leads to various XSS issues and cracks. It's too easy to get the 
admin to follow a link, Indeed this can happen without any explicit user 
request at all.

POST is not which is why it can't be linked to, bookmarked, prefetched, 
used to grab an image, etc.

The issue of using JavaScript to POST without user intervention is an 
interesting question. I need to explore it further. I'm not sure it's 
possible, but I'm not sure it isn't either. I suspect the answer may lie 
in which servers the JavaScript is allowed to talk to, but I'm not a 
JavaScript expert so I'm not yet sure.

-- 
Elliotte Rusty Harold  elharo at metalab.unc.edu
Java I/O 2nd Edition Just Published!
http://www.cafeaulait.org/books/javaio2/
http://www.amazon.com/exec/obidos/ISBN=0596527500/ref=nosim/cafeaulaitA/