Re: [Cppcms-users] empty action in POST a potential vulnerability ?

[Joerg S. <jo...@br...>]

On Mon, Aug 25, 2014 at 01:13:21AM +0300, Marius Cirsta wrote:
>  I was just reading on a blog post that an empty action in post could
> in theory trigger a bypassing of CSRF. Details here:
> 
>  http://blog.andlabs.org/2010/03/bypassing-csrf-protections-with.html
> 
>  Is this true for cppcms ? I've noticed that the wiki code does indeed
> use empty actions in post forms. It would also seem that html5 doesn't
> allow this anymore and that a non empty action must be specified.

I can't make that much sense of the post, but keep in mind that cppcms's
CSRF handler is applied first and an invalid CSRF token gives an
exception without hitting the normal view.

Joerg