Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I came across a website which uses Rails Authenticity token to prevent CSRF attacks. My concern here is that I can see the authenticity token in the source code of the web page. If any other service tries to carry out a CSRF attack and this token is the only thing which prevents it , why can't the attacker service just copy the token and then conduct the attack ?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Having a CSRF token in the body of the page is a standard way of preventing CSRF attacks. The token is different for every form that's presented by the application. so when a form is submitted the submission can be checked for the validity of the token.

If an attacker takes a token from a page that he sees essentially that token won't be of use to him as when any other user visits the same page, the token won't be the same.

If you're looking for more information you could look at the OWASP page on CSRF or this post on StackOverflow about the rails specifics.

share|improve this answer

The problem that CSRF tokens prevent is request forgery. In order to conduct a successful exploit, the attacker would have to receive a copy of the token for the user they're trying to impersonate, not one for themselves. And there's currently no known practical way for an attacker to acquire one of these tokens, when implemented correctly.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.