You can still have XSRF attacks without javascript though… so they are not caused by javascript but facilitated. Harder but doable, and you might protect yourself from some in the wild by turning off javascript.
Reading up about this a bit more it does appear that noscript does help against XSRF even those that don’t use javascript, by changing post requests from untrusted sites to empty gets.
Reading up about this a bit more it does appear that noscript does help against XSRF even those that don’t use javascript, by changing post requests to untrusted sites to empty gets.
Neat. Though I think you meant “changing post requests from untrusted sites to trusted sites to empty gets”, as would be expected to protect against Cross Site Forgery.
You can still have XSRF attacks without javascript though… so they are not caused by javascript but facilitated. Harder but doable, and you might protect yourself from some in the wild by turning off javascript.
Reading up about this a bit more it does appear that noscript does help against XSRF even those that don’t use javascript, by changing post requests from untrusted sites to empty gets.
More details can be found on the noscript developers blog,
Editted: Made correction suggested by child post of JGWeismann,
Neat. Though I think you meant “changing post requests from untrusted sites to trusted sites to empty gets”, as would be expected to protect against Cross Site Forgery.