Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications"

["Sverre H. Huseby" <shh () thathost com>]

[Thomas Schreiber]

|   SESSION RIDING - A Widespread Vulnerability in Today's Web Applications
|   http://www.securenet.de/papers/Session_Riding.pdf

Nice work.

|   In this paper we describe an issue that was raised in 2001 under
|   the name of Cross-Site Request Forgeries (CSRF).

The problem you describe (If I understand correctly) was first (to my
knowledge) described in May 2000 by Jim Fulton in the Zope community.
The fenomenon was baptised "Client Side Trojans" back then.

I totally agree that this problem hasn't got the attention it
deserves, and that an enormous amount of web sites are vulnerable.


Sverre.