Another site can post a form on behalf of a user automatically, and the cookies for job poacher will be sent. Meaning that a malicious site can take actions on behalf of a logged in user.
Perhaps their solution is more complicated than they let on, but I doubt it given it's "20 lines of code".
Rails has CSRF protections baked in; unless you explicitly turn it off, non-GET requests require a CSRF token associated with the user session to complete successfully.
Another site can post a form on behalf of a user automatically, and the cookies for job poacher will be sent. Meaning that a malicious site can take actions on behalf of a logged in user.
Perhaps their solution is more complicated than they let on, but I doubt it given it's "20 lines of code".