On Sat, Mar 13, 2010 at 1:09 PM, Luke <..hidden..> wrote:
On Sat, 13 Mar 2010, Chris Travers wrote:
On Sat, Mar 13, 2010 at 12:12 PM, Luke <..hidden..> wrote:
Furthermore, if we agree that data shouldn't be saved to the db on a
GET request, then the XSRF benefits are the same.
I guess I was thinking more along the lines of packet sniffing and
logging.
http://www.w3.org/Protocols/rfc2616/rfc2616-sec15.html#sec15.1.3
If you can sniff packets, you can pull POST data out as easily.
Really, that's an argument for using SSL, which we document as
extremely highly recommended. Logging is discussed more below.