Hacker News Reader

I'm curious about the technical details of the CSRF bypass vulnerability. Anyone know what the "combinations of browser plugins and HTTP redirects" that lead to it are?

http://groups.google.com/group/rubyonrails-security/browse_t...

View on HN

Same here. Based on the changes made in the patch, it seems like the attack involves being able to make cross-domain requests but not being able to read back the response. I didn't think that was the way Java and Flash behaved.

Reply on news.ycombinator.com