Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

To protect yourself against XSRF, you need to have a separate token on a page.

See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood

As the posting suggests, its best to have those tokens in a hidden field inside your form. But I wonder, if there is any benefit in storing them in an anonymous function instead, so that the value will be added on submit?

While I can see a vulnerability against XSS in the usual approach, there should be no way to submit a valid form in mine. If someone controls the DOM with XSS, the tokens inside hidden fields are easily revealed, unless its an inaccessible javascript variable.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

The problem with this implantation is that the CSRF token is not actually stored within an anonymous function. This token would be stored within text that declares an anonymous function. An XSS payload can request this text from the server using an XHR, the CSRF token can be read and another XHR can be used to send an arbitrary forged request.

Related: Sammy worm explanation, which is a good example of how XSS is used to read a CSRF token. Also, XSS is possible without JavaScript. Now keep in mind the following inequality:

HTTP Response Splitting > XSS > CSRF > Clickjacking
share|improve this answer
add comment

The only time that you need to worry about the token being read is if there's a malicious extension or an MITM attack being carried out.

In both cases, it's no longer a CSRF problem. Both attacks have the capability of catching the request on the fly (after your javascript has assembled it with the token) and modifying it. This isn't CSRF, but it's still a potent attack. (Using HTTPS solves some of this, though you have to assume that the client isn't installing malicious extensions)

If there's an XSS vulnerability somewhere then it's quite easy to call onsubmit() before submitting.

So there really isn't any added safety.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.