--nextPart6163756.eWvOUueb0J
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Am Mittwoch 10 Dezember 2008 schrieb s.gottschall@dd-wrt.com:
> in fact. just a plain POST to a authenticated dd-wrt session. without
> beeing logged in locally it would not have any effect

That's exactly the problem, as this POST can be triggered from a third-part=
y=20
webpage via javascript.

You are familiar with Cross Site Request Forgery attacks? Wikipedia gives s=
ome=20
good introduction:
http://en.wikipedia.org/wiki/CSRF

All forms in web applications doing changes that require authentication nee=
d=20
some extra protection to prevent CSRF. Usually this is done by some random=
=20
token that may be created out of a random session value stored on the=20
application site combined with an id of the form. This has to be checked=20
before any action is executed.



=2D-=20
Hanno B=C3=B6ck Blog: http://www.hboeck.de/
GPG: 3DBD3B20 Jabber/Mail: hanno@hboeck.de

http://www.jukss.de/ Jugemdumweltkongress, 27.12.-4.1.

--nextPart6163756.eWvOUueb0J
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEABECAAYFAklAVAMACgkQr2QksT29OyCdEACeIk/TOGySA+gImzHxe9iuDfqN
z9MAoJl1Kh3hYKtL82TNUbGlTZvprVGu
=M4L+
-----END PGP SIGNATURE-----

--nextPart6163756.eWvOUueb0J--