Reply to thread

Yes ... and no :)


[URL unfurl="true"]https://xenforo.com/community/threads/compatibility-for-csrf-protection-cloudflare-full-html-page-caching.202315/post-1609186[/URL]


Even if the browser supports Sec-Fetch-Site the server couldn't determine if a navigational (-> Sec-Fetch-Mode / Sec-Fetch-Dest) request for Logout originated from an intended user action (eg. clicking Logout in the Accout menu) - or by being tricked into clicking such a link (embedded in a post like here).



Yeah, might be good enough as "last resort" - but not primary source.


Back
Top Bottom