Hacker News Reader

> I reported the issue to Coursera on Sunday, and I have not yet received a response. Possible remediation steps include rate limiting (again), referrer checking, and configuring APIs to always return the same HTTP status.

Wouldn't the 2nd issue (the cross-origin data leak) be better off solved by having a CSRF token instead?

View on HN

That would presumably solve this issue. Perhaps that is what they will end up doing -- hard to say since they haven't addressed this issue yet. The author was guessing at solutions that might help (though, as you've noted, he was mostly off base).

I don't mean to say his suggestion is bad. For what it is worth, I just want to clarify this :) I too, am not too good with security stuff either (still learning!) and thanks!

Seriously though, he's the kind of privacy person you wouldn't think you'd be listening to a law textbook because he obviously is pretty good with web technology.

Hey, you've got other interests aside from coding, don't you? Some people like to bike, some like to play games, some like to study law. Some like to do all three ;)

Reply on news.ycombinator.com