1
vote
1answer
99 views

handle user-session-cookie and csrf token correctly for javascript app

I have a django web app serving restful api endpoints and a javascript web app communicating with those endpoints through ajax. They are under the same domain but in different ports. server api ...
4
votes
1answer
488 views

Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?

The W3C CORS recommendation states: Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins. ... 3. A GET ...
1
vote
2answers
285 views

CSRF protection with cookie and AJAX

I would like to note that I've read the other question with an embarrassingly similar title and it does not contain an answer to my question. I have not used CodeIgniter as a programmer, but I have ...
10
votes
5answers
985 views

CSRF protection with Session Id

To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent? The server would then just ...
0
votes
1answer
403 views

Cookies + CSRF protection + AJAX

In my app (built in Codeigniter), users can submit status updates. When submitting forms, Codeigniter automatically provides a hidden cookie. I can validate that cookie through AJAX when the user ...
3
votes
2answers
2k views

Why are CSRF tokens necessary?

It seems that the entire problem could be solved very elegantly by simply adding a new flag to the HTTP cookie specification. Similarly to how cookies flagged Secure will only be submitted by the ...
7
votes
3answers
3k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
12
votes
3answers
3k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
1
vote
2answers
1k views

header injection + codeigniter

I'm reading through Mozilla's Secure Coding Guidelines, and found this statement: Don't trust any user data (input, headers, cookies etc). Validate it before using it I'm using the codeigniter ...
1
vote
2answers
137 views

I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine?

I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine? Edit Assume the web server has CSRF vulnerability. No hidden token checking ...