Hacker News Reader

Comment by epimenov | Hacker News Reader

he discovered that you can log out from google via a GET request (surprise!)

Specifically,

    <img src="https://mail.google.com/mail/u/0/?logout" style="display: none;">

When your browser loads the page, it requests that "image", which logs you out.

I don't see a way browsers could effectively enable CSRF protections. How is it supposed to know you don't want to request that page as an image? What about sites linking to images on other domains? CDNs would be blocked, because how is Chrome supposed to know you actually wanted to load the image from fbcdn.net or s3.amazonaws.com?

You can prevent the iframe CSRF with X-Frame-Options: SAMEORIGIN I suppose? - maybe browser could implement X-Image-Options: SAMEORIGIN as well - kind of a hotlinking prevention header.

That prevents the result from being displayed, it doesn't prevent the request from being made. The distinction is subtle but hugely important. In other words, the browser makes the request, gets the response, and doesn't render it. The server doesn't know that the browser didn't render it: it treats it like any other request.

Ah you are correct, forgot about that. Thanks for this point.

lol it's just funny trick 4 lulz. It has nothing to do with future stuff

Reply on news.ycombinator.com