An even more subtle attack is that any page returned over HTTP can be potentially altered by an intruder — even URLs embedded in the page.
另一种更狡猾的攻击方法是,入侵者可以修改通过HTTP返回的任何页面——甚至包括页面中嵌入的URL。
During a CSRF attack, requests originate from an intruder site and are transmitted through an authenticated browser page to the server.
在CSRF攻击过程中,请求来自一个入侵者站点,然后通过一个经过验证的浏览器页面传输到服务器。
This attack is only possible if the intruder site gets the mashup page to proxy the requests to the corporate mashup server for the intruder site.
这种攻击只在一种情况下可行:入侵者站点使mashup页面为其将请求代理到企业mashup服务器。
应用推荐