Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine?


Assume the web server has CSRF vulnerability. No hidden token checking will be done on the server.

share|improve this question
up vote 4 down vote accepted

No. CSRF works by using a session already in place, and sessions can only exist within the same browser. Or put another way, all current/major browsers do not share sessions.

EDIT: As noted in the comment, it is theoretically possible using flash cookies. IMO, flash cookies are evil to begin with though.

share|improve this answer
While this is generally true, there are theoretical (and possibly practical) possibilities to conduct current attack via LSO, or so-called flash-cookies. Sure, this heavily depends on application specifics and implementation. – anonymous Mar 5 '11 at 19:28
Good point, @ams. I wonder if this also might apply to Silverlight Isolated Storage, the various HTML5 storage options, web-keys/URL capabilities or any of the other persistence methods used by evercookies. – nealmcb Mar 5 '11 at 20:03
Good point. I didn't take into account plugins. – Steve Mar 5 '11 at 22:06

Assuming that the existing CSRF vulnerability is based on the presence of a login cookie, then the simple answer is no (in the general case).
Different browsers (e.g. IE/FF/GC/Safari) each manage their own cookies, and logging in on one will have no effect whatsoever on the cookies for another browser.

However, there are other CSRF flaws which are no based on cookies, which may be relevant to other browsers.
For example, Integrated Windows Authentication -based CSRF would be relevant for IE, even if you had logged in on say FF. Or any other non-cookie based authentication/session management, including flash-based sessions, etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.