# Populate Data Explorer params with URL params

**URL:** <https://meta.discourse.org/t/populate-data-explorer-params-with-url-params/169404>\
**Category:** Feature\
**Tags:** data-explorer, completed\
**Created:** [November 6, 2020, 7:28am UTC](https://meta.discourse.org/t/populate-data-explorer-params-with-url-params/169404 "2020-11-06T07:28:25Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![lucasbasquerotto](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lucasbasquerotto/32/133376_2.png) [@lucasbasquerotto](https://meta.discourse.org/u/lucasbasquerotto)\
**Post date:** [February 12, 2021, 11:56am UTC](https://meta.discourse.org/t/populate-data-explorer-params-with-url-params/169404/5 "2021-02-12T11:56:20Z")

</div>

It’s just important to note that if a `run` parameter is added, it should not be used if the `same-site` cookie is set to `None` (or `Disabled` and the browser defines `None` as the default).

If the `same-site` is `none`, you could enter some other site and they could make a http GET request, in the same way that CSRF is exploited, although this would not be a CSRF vulnerability per se, but they could execute some really expensive instructions in the [data explorer](https://meta.discourse.org/t/32566?silent=true).

The `same-site` cookie policy is relatively new, but the major browsers already support it for some time, Chrome defaults to Lax, and Discourse too (if I’m not wrong), so it should not be a problem in most cases.

---

_[View the full topic](https://meta.discourse.org/t/populate-data-explorer-params-with-url-params/169404)._