trac user darkwingduck wrote on 39573134-11-22

strange formatting, good work trac! =)

trac user darkwingduck wrote on 39573145-03-22

ps: people who don't have access to the server time may wait for 1+ hours after landing to the first login page on their elgg site, to regenerate this.

trac user darkwingduck wrote on 39573226-04-24

-correction: I hear/experience this pretty often.

brettp wrote on 40088017-12-01

Actions, regardless of logged in status, must be validated through tokens for security. Until the token system can be reexamined, this is a side effect of that system.

trac user darkwingduck wrote on 40088075-01-31

But only 'secure actions', for preventing attacks like cross-site right?

I remember there is a parameter in the gateway to control this behaviour per action. Does it have to be a 'secure' action while the visitor has no access to their account, and it has to be fed with the credentials? Nearly no website uses this scheme for login.

I've probably changed this in our server.

cash wrote on 40853558-08-01

This was fixed in [svn:3972]

ewinslow wrote on 41459052-08-11

Potentially relevant: http://en.wikipedia.org/wiki/Cross-site_request_forgery#Forging_login_requests