POSTs can be forged too, if another vulnerable site permits Javascript on their ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		jerf on May 29, 2014 \| parent \| context \| favorite \| on: Google's XSS game POSTs can be forged too, if another vulnerable site permits Javascript on their domain accidentally (among other ways, but that's the big one).

qu4z-2 on May 30, 2014 [–]

Isn't that CSRF, though?

smsm42 on May 30, 2014 | [–]

CSRF is what allows you to post. XSS is what happens after it is posted.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact