Julia EvansMar 4

I'm back to thinking about CSRF: why is it useful for sites to be able to embed resources (like <img src="othersite.com/whatever.jpg">) and for the browser to send the user's cookies to the third-party site?

There's "ads" and "tracking" obviously but I feel like there's another actually-useful-to-users reason I'm not thinking of

Show threadGlenjamin

@b0rk the one case that I can recall was for Single-Sign-On with an actual shared session (instead of just central credentials)

I forget all of the details now, but recall we had a sign out page that included a resource of each service - so it was single sign out too

Mar 4 at 9:56pmWeb