couchdb-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Florian Weimer>
Subject Futon cannot use the RESTful HTTP API
Date Mon, 08 Feb 2010 21:13:30 GMT
Due to CSRF issues, Futon cannot use that API.  You really need to
include some sort of token in the URL (or in an HTTP header) which
does not get passed on automatically by the browser.  Right now,
you're relying on HttpOnly support in the browser, which is not
available universally.

You also have a cross-site scripting issue with uploaded document
attachments.  Right now, it is possible to use an inline document
attachment in a POST request for a new document to upload Javascript
to the server, and have it served back to you for execution.  At this
point, the same-origin restrictions do not apply anymore.
Unfortunately, it is a bit difficult to stop browsers from
interpreting crafted blobs as HTML, so I have no good advice to offer
here.  Even if the first issue is addressed, you still have to deal
with Futon users viewing attachments accidentally.

View raw message