Obsah diskusie

Ach boze, ake bezpravie, cely server treba zavriet do basy lebo ti poslal cookie a nevyskocil ti banner o tom. Co keby si trosku potrapil mozog/Google a zistil si, co ten nazov cookie asi znamena? https://lmgtfy.com/?q=CSRF+token&s=ghttps://lmgtfy.com/?q=CSRF+token&s=g Hlavne ze sa do vsetkeho vyznas.

A dalsich 5 minut Googlenia by ta doviedlo sem: https://wikis.ec.europa.eu/display/WEBGUIDE/04.+Cookieshttps://wikis.ec.europa.eu/display/WEBGUIDE/04.+Cookies kde by si si precital, ze:

Examples of cookies that generally do NOT require consent:

• User input cookies, for the duration of a session
• Authentication cookies, for the duration of a session
• User-centric security cookies, used to detect authentication abuses and linked to the functionality explicitly requested by the user, for a limited persistent duration
• Multimedia content player session cookies, such as flash player cookies, for the duration of a session
• Load balancing session cookies and other technical cookies, for the duration of session
• User interface customisation cookies, for a browser session or a few hours, when additional information in a prominent location is provided (e.g. “uses cookies” written next to the customisation feature)

Nie je povinnosťou informovať o cookies potrebných pre fungovanie webu. CSRF tokeny neslúžia na identifikáciu užívateľa, ale na ochranu pred clickjackingom.