Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

To protect yourself against XSRF, you need to have a separate token on a page.

See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood

As the posting suggests, its best to have those tokens in a hidden field inside your form. But I wonder, if there is any benefit in storing them in an anonymous function instead, so that the value will be added on submit?

While I can see a vulnerability against XSS in the usual approach, there should be no way to submit a valid form in mine. If someone controls the DOM with XSS, the tokens inside hidden fields are easily revealed, unless its an inaccessible javascript variable.

share|improve this question
up vote 1 down vote accepted

The problem with this implantation is that the CSRF token is not actually stored within an anonymous function. This token would be stored within text that declares an anonymous function. An XSS payload can request this text from the server using an XHR, the CSRF token can be read and another XHR can be used to send an arbitrary forged request.

Related: Sammy worm explanation, which is a good example of how XSS is used to read a CSRF token. Also, XSS is possible without JavaScript. Now keep in mind the following inequality:

HTTP Response Splitting > XSS > CSRF > Clickjacking
share|improve this answer

The only time that you need to worry about the token being read is if there's a malicious extension or an MITM attack being carried out.

In both cases, it's no longer a CSRF problem. Both attacks have the capability of catching the request on the fly (after your javascript has assembled it with the token) and modifying it. This isn't CSRF, but it's still a potent attack. (Using HTTPS solves some of this, though you have to assume that the client isn't installing malicious extensions)

If there's an XSS vulnerability somewhere then it's quite easy to call onsubmit() before submitting.

So there really isn't any added safety.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.