It seems to me that the subscriptions tab in the profile settings page is susceptible to CSRF attacks since the links to remove yourself from subscriptions are just plain html links. Please correct if I am wrong or CSRF is the wrong terminology for this.

I tried copying one of the links to remove a subscription to a new tab and it actually unsubscribed me.

Would it be possible to change this to update via POST, optionally with a CSRF token to prevent CSRF attacks?

  • 3
    Hmm, that doesn't look great. Kind-of silly and pointless to abuse, but better to do it right. – Jeremy Banks Oct 9 '17 at 16:33

You must log in to answer this question.

Browse other questions tagged .