Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This is something I haven't been able wrap my head around, if BREACH allow leaking of information, do we have to mask or generate CSRF token in a time-based or per-request fashion to make it more secure?

As far as I know, session-based CSRF token can protect user from CSRF just fine. But how accurate is this in context regarding SSL? The problem here is no longer whether attacker can perform CSRF, but whether such CSRF token can be extracted from HTTPS with compression on, even be used to leak other information?

Basically I am asking if this older question now have an different answer.

share|improve this question
add comment

1 Answer

To answer your question: It is still secure, if you dont use session-based CSRF-tokens AND HTTP-Compression (see explanation below)


from breachattack.com / Am I affected?

If you have an HTTP response body that meets ALL the following conditions, you might be vulnerable:

  • HTTP-Compression Your page is served with HTTP compression enabled (GZIP / DEFLATE)
  • User Data: Your page reflects user data via query string or POST parameters
  • A Secret: Your application page serves PII, a CSRF token, sensitive data

Mitigations / ordered by effectiveness

  1. Disabling HTTP compression
  2. Separating secrets from user input
  3. Randomizing secrets per request
  4. Masking secrets (effectively randomizing by XORing with a random secret per request)
  5. Protecting vulnerable pages with CSRF
  6. Length hiding (by adding random number of bytes to the responses)
  7. Rate-limiting the requests

share|improve this answer
    
Protecting vulnerable pages with CSRF - the page doesn't really go into what type of CSRF token implementation is secure, which is more or less my question. –  bitinn Oct 11 '13 at 8:19
    
One of the migitations is randomizing secrets per request as opposed to a secret per session, so isnt this answer is also saying; No it is not secure to use session based csrf –  user1066946 Oct 11 '13 at 12:31
    
@Philipp: No it is not secure to use session based csrf + HTTP-Compression; i cleared my answer –  that guy from over there Oct 11 '13 at 13:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.