Clojurians Log v2
Clojure programming
Channels
Apps
ring
Endre Bakken Stovner 2020-02-07T22:46:12.014600Z
Web noob here: is there any point at all with a CSRF-token for a same machine app? (Using clj for computation, cljs for visualization in browser). I am 99.999% sure there is not
jumar 2020-02-08T08:48:56.017200Z
What does the same machine app mean? Do you have any post handlers in your app?
Endre Bakken Stovner 2020-02-10T19:08:42.017400Z
Yes, there are post handlers which the user uses to send data to the running application 🙂 Same-machine app: meant to be used on the same machine, not serve web pages to clients (dunno if this is the terminology)
jumar 2020-02-10T19:21:25.020Z
Who’s gonna consume the cljs app then? Is it only going to run locally and never ever served over a network? In that case I’d say you’re pretty safe :)
2020-02-11T18:03:48.020200Z
CSRF covers the confused deputy attack, which relies on an attacker tricking a user into making a request on their behalf.
2020-02-11T18:04:47.020400Z
It’s a problem if an attacker knows about your system and where it is, and can get you to visit a website under their control.
aisamu 2020-02-07T22:54:28.015600Z
I'll add an extra 9 to your confidence value