> We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.
replyThis has been a thing since forever lol
Security software fetching links will not trigger this behavior. It needs to be done in the context of the actual ChatGPT user so that a JavaScript payload can run.
replyIf merely GET on the link was sufficient to trigger the behaviors, the adversary generating the link would just GET it themselves.
Yes, if it requires the user session (xss related), like the article, there is no problem.
replyI was replying more generally about the "don't click links" advice and cases of server generated confirmation-token links (not saying this was the case at OpenAI)
[flagged]
reply