javascript security rails

Question

Let's say I have a page where a user has an option to like a dislike something. The like or dislike actions send a post message to a control which increments/decrements the number of likes on a object. However, the user is not logged in when they do this action.

How can I protect this page from javascript code that automatically clicks on like or dislike. Right now, after the user clicks one of them, that entire container becomes hidden, but couldnt someone use javascript (in the url/bookmarklet) to bring it back and then execute a click?

Post sample code. Simplify your problem.

phpmeh
– phpmeh

2011-12-06 04:16:34 +00:00
Commented Dec 6, 2011 at 4:16 — phpmeh
– phpmeh, Commented Dec 6, 2011 at 4:16

rook · Accepted Answer · 2011-12-06 07:06:31Z

1

Security problems include CSRF, Clickjacking and the Coup d'état for this poorly planed feature is that ip addresses are basically free. So if anyone wants to upvote, they can and they can do so as much as they want. If you want to slow them down you need a captcha to protect it.

edited Dec 6, 2011 at 7:06

answered Dec 6, 2011 at 6:33

rook

67.1k38 gold badges171 silver badges248 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

javascript security rails

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related