sakaiproject/Hilary — pull request #400 by mrvisser (2013-03-07 17:52:29+00:00)
Title: CSRF vulnerability

Currently, CSRF attacks are quite easy to do on Hilary, even with secure browsers.

```html

You stink!

```

Store that locally and post the action host to your instance, and you can log yourself out. This can be done with any other post action.

The ServerProtectionService in Nakamura checked the referrer to ensure to ensure that it comes from the same host. We should use this as well to protect against this kind of attack.