Other nomination
How to defeat digg.com
A walkthrough of session riding (CSRF) against digg.com. A zero-size iframe is filled by JavaScript with a POST form, and because IE and Firefox send no Referer for a frame built by script, referer checks fail; only Opera resists. The page itself diggs a story on load as the demo. The fix given is a single-use token in every form and link.
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.