Hacker News Reader

Is the following accurate:

If a form is served from domain A (via GET) in to an iframe on a page that was served from domain B, then the JS on the page from domain B is prevented from reading or writing data on the page from domain A (unless an x-domain policy is in place) though it may be able to post it.

View on HN

Yes it wont be able to read it. But that's not what they are after. What they do want is to execute some user action on the server side. So this action would have taken place just by executing the GET/POST request.

Thank you. I just wanted to make sure I understood the basis of why CRSF Tokens work.

Reply on news.ycombinator.com