pbrisbin/devsite — Issue #2: CSRF for /manage/delete/#T.Text
Author: Tarrasch
Created: 2012-01-06 15:36:00+00:00
State: open

Hello, I know it's not at all my business how you run your site, however you might still find interest in this.

If I'm not mistaken if an external site links to say `$APPROOT/manage/delete/cool_slug`, and one accidentally clicks it and is having an logged in session at your site, then that post would be deleted, no? I'm not an expert on this so correct me if I'm wrong.

I've myself implemented something like your system of documents for my own site. If the issue exists I'm gonna fix it for my own site (and I can show you my commit how I did it).

But knowing you are a lot more experienced with yesod and web, I thought I ask you for advice how you would fix this. Also, CSRF works for `/auth/logout`. Is that a yesod issue?

So I'm opening this issue to inform and ask for your kind advice on how one could fix this "the yesod way". Do you have any input?