Re: First-Party-Only cookies

Mark Goodwin <[email protected]> Wed, 20 Jan 2016 10:57:27 +0000

Newsgroups	gmane.comp.mozilla.security
Message-ID	<CAGXeGtLeq0SbwOhTAuAWzXh+KVW-eq2Q8Fk7XriFJf28R7OLRA@mail.gmail.com>

On Wed, Jan 20, 2016 at 2:46 AM, Martin Thomson <[email protected]> wrote:

> Besides, sites shouldn't be using safe methods to change state.  I
> know that that is often convenient, but don't we provide plenty of
> better alternatives already?
>

Yes. But it's frighteningly common (particularly in older applications) to
see things like:

doGet(request, response) {
  doPost(request, response);
}

(or vice versa)