Collected research

How to defeat digg.com

Digger's blog

A walkthrough of session riding (CSRF) against digg.com. A zero-size iframe is filled by JavaScript with a POST form, and because IE and Firefox send no Referer for a frame built by script, referer checks fail; only Opera resists. The page itself diggs a story on load as the demo. The fix given is a single-use token in every form and link.

Record

Document

Digger's blog

Published by

4diggers.blogspot.com

Topic

Other

In the archive

• Collected in the 2006 research round

Tags

• csrf
• iframe
• javascript
• cookie
• abuse-of-functionality
• mitigation
• case-study
• owasp-a01-2021
• owasp-a04-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of 4diggers.blogspot.com, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.