Couchmail/couchmail — Issue #14: Add double cookie trick to mitigate CSRF attacks.
Author: blubber
Created: 2011-10-10 09:02:44+00:00
State: open
Labels: api

All POST and PUT requests should require the client to submit the session id twice, as cookie and as request parameter. This will prevent CSRF attacks by using the browser's same origin policy.