Julia EvansMar 4

I'm back to thinking about CSRF: why is it useful for sites to be able to embed resources (like <img src="othersite.com/whatever.jpg">) and for the browser to send the user's cookies to the third-party site?

There's "ads" and "tracking" obviously but I feel like there's another actually-useful-to-users reason I'm not thinking of

Show threadÖlbaum
@b0rk I’m logged in on a web site. It shows me a graph of my company’s revenue. I’m the only one allowed to see it, but it’s served from a different domain, for architectural reasons. My session cookie is needed. Does that apply?
Mar 9 at 12:52amWeb