On: Major exploit found on reddit

"Remember that if a user is logged in, an external site can have code like img src="http://yoursite/op.cgi?delete=all""

You shouldn't be using GET for anything that has side effects.

You probably know this, but the same is applicable to "cross-site request forgeries" in general, they just aren't as trivial to exploit as img src. If they can perform a GET they can perhaps use javascript to import confidential information into a loaded page and scrape that.

POST requests aren't safe from tricks by third-party sites either, as is mentioned here for example: http://www.owasp.org/index.php/Cross-Site_Request_Forgery

(Open Web Application Security Project looks interesting otherwise too.)

Good point, but with ajax this is very common. There are also frameworks that abstract "params" into GET+POST+COOKIES, since they are all under user control in theory the security level is the same, but actually the img trick changes this.