On: How to boost your popularity on OkCupid using CSRF...

[SergeAx]

This would be unable if OkCupid stored its credentials in sessionStorage or localStorage instead of cookies, right?

[amenghra → SergeAx]

With modern browsers, there are almost a dozen ways to defend against csrf. You can use sessionStorage and force all requests to be XHR. Set the “new” flag on session cookies to not transmit cross origin. Check the origin header for all POST requests. Set a token in the forms (the “classic” way).