Hacker News Reader

How is this a DoS? It's not significantly more resource-intensive than any other request. If you could submit enough of these requests to DoS the server, you could submit enough of any request to DoS the server, so the server is no more vulnerable this way than otherwise.

View on HN

It allows you to grief the users of any rails site. You can log them out at will (for some value of at will).

In the dawn of time, you could use a CSRF exploit and really grief the users. Then CSRF checking made that go away. This is now a step backwards, where 3rd party sites can affect your users.

You can't log any arbitrary out of their sessions. It only resets your session, as in the session cookie is reset.

No, you, as an evil website operator, can cause anyone who visits your site to log out of any arbitrary rails site.

Reply on news.ycombinator.com