List: websecurity@lists.webappsec.org
From: Michal Zalewski
Re: [WEB SECURITY] CSRF: Flash + 307 redirect = Game Over
Thu, Feb 10, 2011 9:38 PM
As with much of the web, there isn't one (and if there was, it would
probably have nothing to do with reality).
That said, it is commonly understood, and enforced by most places
(e.g., XMLHttpRequest), that websites should not be able to make
cross-domain requests with arbitrary HTTP headers without some sort of
a mutual consent (e.g., CORS).