Sina Weibo is also a very serious fan of CSRF.

1. Add the follow interface POST to GET; 2. Do not just brush fans, xss can steal identities, and csrf can do the same! 1. Is this site SA: http://caipiao.weibo.com, First Login, fill in the information spread! 2. Add attention to the interface is originally a POST request, the results I tried a simple, direct GET can also be sprinkled, this can not forgive Oh, as follows: http://w.aicai.com/ajaxCareFriend.do? Uid = 1981622273 direct access. Let's see who follows Weibo: 3. let's look at another problem. CSRF binds the mailbox, retrieves the password, and enters the [Security Center]: 4. in the mailbox, click set now and fill in the prepared QQ mailbox: 5. capture the request and prepare a POC page for the post request. If the request can be GET, the trouble will be high: Solution:

1. the CSRF should be thoroughly checked, not just the two places; 2. it has been proved by practice that you can directly GET the bound email address, which is troublesome. the key interface does not perform user verification. For example, you are prompted to enter the password before binding an email or mobile phone. Even setting an image verification code can prevent this situation.