When I'm visiting a website on the public internet, the website can cause my browser to send requests to a local IP address (such as 10.0.0.1). This can be used to attack internal web sites, e.g., ...
I am designing a RESTful API which is to be accessible from a web browser. The API is protected by Basic authentication. I understand the concept of CSRF, and the mitigations proposed (I found both ...
Considering this picture: taken from here:page21 Is this possible? If so, How to prevent it?
I know how a form tag is prone to CSRF which does not use any token (or any other challenge-response mechanism) but I was wondering how an iFrame can be used to cause XSRF attack and what would be the ...
There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet. I've created tokens as a md5 of username, form info and a salt and stored it ...