Death by 1000 cuts

[iago]

This is a cool story about how a bunch of minor issues in a Web application can be combined to gain access:

http://ha.ckers.org/deathby1000cuts/

[rabbit]

Good read.  Though it wasn't exactly 1000...

[iago]

"1000 cuts" is a figure of speech. :P

[Hitmen]

"1000 cuts" is a figure of speech. :P

Mmm torture. Lingchi, fun stuff.

[Camel]

I can't believe people actually consider CSRF to be minor! The name alone instills fear in to the hearts of developers around here.

[iago]

I can't believe people actually consider CSRF to be minor! The name alone instills fear in to the hearts of developers around here.

It strongly depends on the situation.

But I agree, it's often non-minor, just not well understood.

[Camel]

Incidentally, if you use GWT, your apps will be inherently safe vs CSRF and XSS, so long as you do not go out of your way to work around the security that's built in (publishing login tokens, writing vulnerable pure-javascript, etc)