Turn cross-site POST requests into data-less GET requests

vadium · Post by **vadium** » Tue May 24, 2011 5:34 am

I am trying to trigger the functionality "Turn cross-site POST requests into data-less GET requests" however I can't seem to make it trigger...

This code does not appear to be converted to a sanatized GET, although it could be because im running the code locally, dont have an external host to throw it up on at the moment.

<html>

<body>

<form name=TheForm action="http://www.example.com/" method='POST'>

<input type=hidden name='fields[]' value='badstuffyo' />

</form>

<script>

document.TheForm.submit();

</script>

</body>

</html>

This is what this option is supposed to block right? Or have I mis-understood...

Cheers,
VADiUM

Post by **Giorgio Maone** » Tue May 24, 2011 8:01 am

This option applies (by default) to requests originating from non-whitelisted sites and landing on whitelisted ones.

If you want a more generic and flexible anti-CSRF tool, check ABE.

InformAction Forums

Turn cross-site POST requests into data-less GET requests

Turn cross-site POST requests into data-less GET requests

Re: Turn cross-site POST requests into data-less GET request