Home/ Questions/Q 4596286
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-21T23:05:37+00:00

Feeds produced by Google contain a strange comment: <!– Content-type: Preventing XSRF in IE.

  • 0

Feeds produced by Google contain a strange comment:

<!-- Content-type: Preventing XSRF in IE. -->

For example, you can see it near the top of this feed. Can anyone explain the purpose of that comment?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    It seems benhoyt on hacker news asked and answered this question.

    I’ve just been tightening up our upcoming microPledge website — http://micropledge.com — to prevent cross-site request forgery (CSRF). I added a random SHA as a form key to each form.
    But! Then I discovered this lovely IE security hole. An attacker can use cross-domain JavaScript and an mhtml: redirect to grab the page, get the form key, and then do the POST. Brilliant! Anyone have any experience in getting around this?

    …

    IE parses the first part of an MHTML document as HTTP-style headers, so if you have an HTML comment at the start of your pages with “Content-Type: Something crazy” followed by a blank line, that fixes it.

    • 0