






<p class="lift:ClassName.methodName">Replace me</p>
"p *" #> "Twilight Sparkle is best pony!"
<p>Twilight Sparkle is best pony!</p>

http://localhost:8080/rest/pony/best
Unpredictable urls are immune to both attacks.


() => Pony
http://localhost:8080/ajax_request/F246253955771TQNMAV/
ponyService.getBestPony().then(function(pony) {$scope.pony = pony;})
<script> angular.module('lift.pony') .factory('ponyService', function (...) { return { getBestPony: function() {...} }; };</script>

