a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

learn more… | top users | synonyms

3
votes
3answers
50 views

What CSRF attacks will 'First-Party-Only' cookies protect against?

The new 'First-Party-Only' cookie attribute: ... allows servers to assert that a cookie ought to be sent only in a "first-party" context. This assertion allows user agents to mitigate ...
5
votes
3answers
554 views

Can CSRF attacks steal log in information?

Sorry very new to security. If a user is logged into a secure site (credentials are SSN and a password) and then is victim to a CSRF, can their log in information be at risk?
3
votes
1answer
68 views

Could somebody explain how the ASDA site is vulnerable?

I'm sure many of you will have seen the CSRF exploit highlighted by Paul Moore that ASDA have known about for two years (Paul's blog) I am trying to find an explanation as to WHY the website is ...
1
vote
1answer
44 views

Security concerns of HTML echo endpoint

Consider a website with an endpoint that, when a payload of an HTML string (full document or partial segment) is POST to it, the server will transform the payload (and sometimes no transform is ...
0
votes
0answers
121 views

Avoiding Client impersonation with Rest Api

I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For ...
0
votes
0answers
32 views

Client Side Attacks - XSS and CSRF [duplicate]

It is against the law injecting JavaScript scripts (simple pop out alert) or capturing and modifying with Burp/Fiddler HTTP request for identifying web application vulnerabilities (CSRF) without the ...
1
vote
1answer
83 views

Single Page Application session management

I have a Single Page Application which is fully HTML+JS+CSS (using frameworks such as jQuery and AngularJS) and a server side API using ASP.NET WebApi. The SPA is served in a server similar to a CDN ...
0
votes
2answers
31 views

Can F5's Big-IP ASM protect against CSRF for AJAX calls?

I know that F5's Big-Ip ASM offers protection against CSRF regarding links and forms. However, when it comes to AJAX calls their documentation is somewhat ambiguous. I understand that they DO NOT ...
-1
votes
1answer
39 views

Token in URL changes on click [closed]

Logging into OpenCart admin, I find a token in its URL: http://localhost/opencart/admin/index.php?route=common/dashboard&token=xOHq2UzQ0YwKTubXgxNpGFySmAA9W90z The synchronizer token pattern is ...
1
vote
1answer
31 views

Logout CSRF Protection [duplicate]

I am making a CMS and I have a CSRF protection in settings, new article. Should I also put this protection in the logout ?
4
votes
2answers
83 views

Prevent CSRF attack using regular expression, session storage, and auth token?

User login to my Web API Service using his user name and password. Web API Service response auth token to client browser. Client browser save auth token to session storage using JavaScript. Client ...
9
votes
2answers
58 views

Personal stylesheets

In reference to this question, I was researching whether or not there would be any security risks in letting users add their own stylesheets. He brings up a scenario in which a dev might use ...
4
votes
1answer
34 views

CSRF issues in “stateless” web app?

So I have developed a web application, which also has an API. API supports both GET and POST requests. The API is completely stateless, means nothing is stored or modified in a database/file when ...
6
votes
1answer
90 views

Alternative to anti-CSRF tokens for AJAX request (Same Origin Policy)

I'm working on a PHP website based entirely on AJAX (via jQuery). It's a single page in which all requests are made by AJAX. Related to the protection against CSRF I have encountered the problem of ...
1
vote
1answer
69 views

CSRF tokens in Single Page Applications (JavaScript/Angular)

I have an AngularJS SPA served by Apache on a cheap web host. All communication to the backend is via Ajax REST calls to an expensive cloud server running Tomcat. How can the REST calls be protected ...
0
votes
1answer
61 views

Exploiting CSRF PUT request

If the application uses RESTful communication, does it need to have CSRF protection for PUT and DELETE requests? As per my understanding its not possible to trigger a PUT request using JavaScript and ...
0
votes
1answer
62 views

Does creation of dump data would be considered as vulnerablity?

Problem behind the question : We were a small firm developing a small web application which was similar to fb,gmail,etc [in terms of functionality]. We have a signup form and I was assigned to test ...
1
vote
1answer
51 views

CSRF Encrypted Token Pattern — need for 'nonce'?

For anti-CSRF Encrypted Token Pattern, the OWASP page describes the pre-encrypted token as being composed of three items: the user's ID, a timestamp value and a nonce. The programmatic need for the ...
1
vote
3answers
59 views

Is there any danger from CSRF if a webservice doesn't impact server data?

I've been reading about CSRF and how it works, and, if I understood correctly, the 'only' thing an attacker can do is force the user to perform actions he didn't intend. I understand the danger if ...
5
votes
2answers
72 views

What to use as 'state' in OAuth2 Authorization Code Grant workflow

I'm using csrf protection in my web app. Now I'm planning to trigger a OAuth2 Authorization Code Grant workflow, starting with a static template opened in a new browser window using ...
2
votes
0answers
22 views

Why has the “Origin” HTTP header not been universally adopted? [duplicate]

After running tests on a few browsers on browserscope.org, I noted that neither Firefox or IE have adopted the "Origin" HTTP header. This header is a useful and valid way of helping prevent CSRF ...
1
vote
0answers
23 views

CSRF attack - Set custom CSRF Header [duplicate]

The title is a little bit unclear but I had no idea to describe the following issue in there. I found a vulnerability in a website where I am able to bypass the CSRF protection (Bug Bounty ...
3
votes
0answers
74 views

How does github.com implement CSRF mitigation

I had a look into CSRF recently. The recommended mitigation strategy is to implement the Synchronizer Token Pattern. When you look at the details, the question comes up how often these tokens need to ...
0
votes
0answers
31 views

XSS script syntax problem

I have a server running on port 4444 on localhost that just echoes messages it receives. I have a JS script embedded in a message that is supposed to send the cookies of whoever looks at it. Here ...
2
votes
3answers
69 views

How does a CSRF logout pose a potential threat to a website?

Websites like SuperLogout logs the user out from websites at one go. I want to know in what way does this pose a potential threat to the users of the website ? How can this be combined with a ...
2
votes
0answers
73 views

Is it secure to use one CSRF token multiple times?

I am new to the CSRF problem and I am studying how CSRF protection is implemented in popular applications like Facebook, Instagram etc. Now I am studying how CSRF protection is used in OAuth ...
1
vote
3answers
180 views

Need help understanding Windows Authentication mechanism

Even if I enforce HTTPS and use anti-forgery tokens, it seems like Windows Authentication could be inherently insecure because it does not require that the user explicitly passes credentials from the ...
2
votes
0answers
144 views

Astonishing Recent Belkin Router Auth Bypass Vulnerability: CSRF Used to Exploit?

I was visiting the CERT site main page today for another reason when I glanced at the list of recent vulnerability bulletins and came across some news I had somehow missed before today: a notice that ...
1
vote
2answers
151 views

CSRF by manipulating HTTP headers from client side using JavaScript

I am trying to do CSRF vulnerability analysis for my website. My website uses an anti-CSRF-token which is sent by the server to the client with the session cookie and then Javascript in the client ...
2
votes
2answers
134 views

Are these four HTTP headers protection against Cross-Frame Scripting enough?

I would like to ask a question what is the best protection against Cross-Frame Scripting. I have set up my webserver to adding these flags into HTTP HEADER: X-Same-Domain: 1 X-Content-Type-Options: ...
1
vote
2answers
297 views

Should I invest my time in making my site HTTPS-only?

I'm building a Django website that does not need to have registration/authentication. The only sensitive part is a form with a reCaptcha v2. Of course I'm embedding the CSRF token, which then I read ...
0
votes
1answer
61 views

Does custom header for CSRF protection invalidate CSRF protection

A penetration testing is ordered on one of the web sites. I have implemented OWASP CSRF Guard on the web site. It uses custom headers for CSRF protection for AJAX. This got flagged with subject ...
0
votes
1answer
117 views

Is sharing a CSRF token between Rails apps secure?

We use an nginx reverse proxy to host two Rails apps under the same domain (one /path leads to another 'secondary' app). The 'secondary' app that lives under a path consumes REST APIs from the 'main' ...
5
votes
4answers
120 views

Is it worth checking the referrer?

I have researching CSRF and one thing on the list, I feel is questionable. I am not sure if "checking the referrer" is worth doing or not. Some articles I read, are saying something of this ...
-3
votes
1answer
113 views

Does anti-CSRF token really protect from CSRF? [duplicate]

I have been reading all over the internet that I should have CSRF token on my page and this will protect it from CSRF. However, I can imagine a scenario where anti-CSRF is not helpful. Is my ...
1
vote
2answers
192 views

Will Wordpress nonces protect against Login CSRF?

Can Wordpress Nonces be used to protect against Login CSRF? https://codex.wordpress.org/WordPress_Nonces I glanced through the code for the function and it seems to only be using the User ID for ...
3
votes
1answer
342 views

Why is referer checking needed for Django to prevent CSRF

Today I learned that Django's CSRF protection uses refer(r)er header checking in addition to checking a hidden form field against a cookie. It seems to be important, judging from docs and issue below. ...
1
vote
4answers
335 views

about CSRF on form submit [duplicate]

I'm surely missing something in the picture of how CSRF attacks and protections are working. My understanding in a form-submit scenery is the protection rely on a unpredictable token, someway is ...
10
votes
1answer
692 views

Why can't you steal the synchroniser token to do CSRF? [duplicate]

I'm reading up on CSRF and I came across synchroniser tokens. I don't understand why you can't do a CSRF to get the token to do a real CSRF. Example: bank.com has a form like this at ...
3
votes
2answers
154 views

Is this an appropriate anti-CSRF method?

I have the following system in place on my web app and I'd like to know if it's secure. Cookie contains CSRF token. Application detects CSRF token in cookie. Application places token in a header. ...
1
vote
0answers
56 views

Is it okay to add CSRF synchronized token by modifying HTML from a valve/filter?

Is it okay to modify the html and add a hidden field containing the CSRF token to all the forms inside a page using a valve or a filter before going to the browser? I'm thinking on this line since I ...
1
vote
1answer
114 views

Handling CSRF tokens on pages longer than the PHP session limit

I have a page that is open (i.e. requires no login) and allows users to give quick feedback. This page is available on a single shared PC or tablet. The form itself has a CSRF token on it. Problem is ...
4
votes
2answers
92 views

CSRF expiring before form submitted

I have a very long web form that could take hours for people to complete. The problem with this is when people take too long the CSRF token expires before they're done and when they hit submit they ...
1
vote
0answers
36 views

Is it necessary to add CSRF tokens for REST API? [duplicate]

I have a few REST APIs for an iPhone app. It has a login and session management functionality. Currently the session has been tracked by a token set during login. Are REST services affected by CSRF ...
2
votes
0answers
125 views

Is it safe to store bearer tokens in an iframe and/or pass them back to the parent window

I am not a security expert, so I am hoping that a few of you might be able to tell me if there are any gaping flaws in the security design for my web app. Hopefully I'll be able to explain this ...
6
votes
1answer
220 views

PHP bin2hex vulnerable to timing attack?

I've read in a few places[1][2][3] of the desire to make PHP's bin2hex constant time. In what scenarios would bin2hex be vulnerable to a timing attack? Is this below code for handling a CSRF token ...
1
vote
1answer
41 views

how to test for csrf if the web application is not using tokens and there are no users defined for that application?

I am testing an application that doesn't use anti-csrf tokens for its requests. There are no users defined for this application as well. Well, in that case, how to carry out testing for csrf in this ...
5
votes
3answers
800 views

Is it secure not to have csrf protection in login forms?

I have noticed that WordPress doesn't have csrf protection for their admin panel login /wp-admin/. Does it actually posses any potential risk? Is there any possible ways there an attacker could ...
8
votes
3answers
689 views

Why is the synchronizer token pattern preferred over the origin header check to prevent CSRF

I am well aware of the concept of CSRF, and I think I am also aware of the possible protection possibilities, as described by OWASP. However, I'm not sure why the synchronizer pattern seems to be ...
0
votes
1answer
282 views

How to check the origin header server-wide in IIS to prevent CSRF

Whereas I'm aware that the synchronizer pattern is the recommended approach to prevent CSRF attacks, I am in a situation where it would be a lot faster to implement the origin header check. I was ...