CSRF-tokens on pages without no-cache headers, resulting in ATO when using CloudFlare proxy (Web Cache Deception)
该报告还没有中文解读。
原文摘录
摘自原文（8250 字符中的一小部分）
I noticed this issue on one of your clients which was using CloudFlare in front of their Discourse. This is not affecting `try.discourse.org` but the same underlying issue can be seen there as well even though it's not exploitable on that specific domain.
原文中的代码
/u/my/preferences.css /u/my/preferences/username.css /u/my/preferences/card-badge.css
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Discourse 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @fransrosen · 版权归作者与 Discourse 所有