Suggestions for the future on your web site: (was cookies, and before that Re: Dreamhost hijacking my prefix...)

Thu Jan 17 22:55:59 UTC 2013

------- mpalmer at hezmatt.org wrote: -------
From: Matt Palmer <mpalmer at hezmatt.org>
[Cookies on stat.ripe.net]

On Wed, Jan 16, 2013 at 11:36:25AM -0800, Shrdlu wrote:
> The cookie stays around for a YEAR (if I let it), and has the
> following stuff:

CSRF protection is one of the few valid uses of a cookie.  
<snip>
By the way, if anyone *does* know of a good and reliable way to prevent CSRF
without the need for any cookies or persistent server-side session state,
I'd love to know how.  Ten minutes with Google hasn't provided any useful
information.
-----------------------------------------

But, if I understand correctly, it only only if you are authenticated can
anything bad be made to happen:

https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29

"CSRF attacks generally target functions that cause a state change on the 
server but can also be used to access sensitive data.

For most sites, browsers will automatically include with such requests any 
credentials associated with the site, such as the user's session cookie, 
basic auth credentials, IP address, Windows domain credentials, etc. 
Therefore, if the user is currently authenticated to the site, the site will 
have no way to distinguish this from a legitimate user request.

In this way, the attacker can make the victim perform actions that they 
didn't intend to, such as logout, purchase item, change account information, 
retrieve account information, or any other function provided by the 
vulnerable website."

So, if someone is just looking around, why is the cookie needed?  

scott