Simon Willison’s Weblog

Items tagged rails in 2011

Filters: Year: 2011 × rails ×


Can someone improve their knowledge of programming in Ruby or PHP by using a framework like Rails or Zend, or does the framework just do a lot of the work for you without giving you an opportunity to learn from it?

Read the source, luke.

[... 82 words]

CSRF: Flash + 307 redirect = Game Over. Here’s the exploit that Django and Rails both just released fixes for. It’s actually a flaw in the Flash player. Flash isn’t meant to be able to make cross-domain HTTP requests with custom HTTP headers unless the crossdomain.xml file on the other domain allows them to, but it turns out a 307 redirect (like a 302, but allows POST data to be forwarded) confuses the Flash player in to not checking the crossdomain.xml on the host it is being redirect to. # 10th February 2011, 10:07 pm