title: REST and CSRF (Cross-Site Request Forgery)
body: <p>Is Cross-Site Request Forgery possible against a stateless RESTful service?</p>
  
  <p>I'm not talking about pseudo-REST where the server remembers that you're logged in via a cookie.  I'm talking about pure no-application-state-on-the-server REST with no cookies.</p>
  
  <p>I'm using SSL and Basic Authentication.  For every request, that Authorization header has to be there.  There is no "session" in the JSP sense, although there is some sort of session at the SSL level.</p>
  
  <p>So let's assume I'm viewing the legitimate web page that makes Ajax requests, and somehow I go to a different page in the same tab or a different tab, and that page makes the same Ajax request.  (I'm assuming there is no malicious code on the legitimate web page; that's a different thing entirely and anything is possible in that case.)</p>
  
  <p>When the second page makes the Ajax request, will the browser put on the same Authorization header? i.e. will the browser say "Oh, you want to go THERE again?  Hey, I just happen to still have the key!"?</p>
  
  <p>Also, couldn't the malicious script do the xhr request, then in the callback take the request from the ioargs, get the Authorization header and un-Base64 the name and password?</p>