a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

learn more… | top users | synonyms

33
votes
2answers
60k views

Why is the Access-Control-Allow-Origin header necessary?

I understand the purpose of the Access-Control-Allow-Credentials header, but can't see what problem the Access-Control-Allow-Origin header solves. More precisely, it's easy to see how, if cross-...
4
votes
4answers
509 views

Is CORS helping in anyway against Cross-Site Forgery?

I've been reading in the last couple of days about CORS and in a lot of places it's mentioned as it is a "Security" feature to help the world from cross domain forgery. I still don't see the benefit ...
5
votes
1answer
1k views

Does returning Access-Control-Allow-Origin: * weaken the security of JSON GET responses?

The W3C CORS recommendation states: Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins. ... 3. A GET ...
8
votes
3answers
2k views

If I never want cross origin requests to be accepted, can I just ignore CORS?

The CORS spec states that if a request method and headers are not simple then a preflight HTTP OPTIONS request is sent to see if the request is allowed by the server. My server does not respond with ...
-1
votes
1answer
31 views

Hosting CSRF Token at URL

When implementing CSRF protection, one generally uses a CSRF cookie that must be included in the body of the request. This prevents CSRF attacks because the malicious website cannot read the other ...
1
vote
1answer
40 views

How is CSRF token verified?

I would like to know how the CSRF tokens are verified on form submit? Please tell me whether the following is correct: Server issues a random string which is set as the session cookie, and a value ...
4
votes
2answers
73 views

Is there any effective server-side prevention technique against PHP-aided CSRF?

I'm gonna start by saying it: I'm merely a cybersecurity enthusiast, not an expert. Thus, I'm gonna state what I think I know so far, please feel free to correct me at any time. Through my readings, ...
0
votes
0answers
44 views

How do anti cross-site request forgery tokens work?

Can anyone explain how CSRF tokens work in simple terms? Why should the CSRF-token be stored in a session cookie as well as in a hidden form field?
6
votes
3answers
170 views

Does CSRF work when the target site is not open on a tab?

This is an example attack scenario of OWASP for CSRF The application allows a user to submit a state changing request that does not include anything secret. For example: http://example.com/...
10
votes
3answers
8k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
0
votes
2answers
116 views

Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?

The Python code below should grab a "csrf token" cookie from Instagram.com, but I get an error message when running the program through any sort of https or socks5 proxy, informing me that the "csrf" ...
12
votes
2answers
11k views

Does ASP.NET Viewstate implicitly prevent CSRF attacks? What does this mean for MVC?

If an encrypted ASP.NET Viewstate is submitted with every form, and control POST, does that mean that ASP.NET is less vulnerable to CSRF than other solutions with this? What is the extent and ...
0
votes
1answer
21 views

Anti CSRF tokens with a black box

Consider an app you develop that uses something like the OWASP CSRFGuard library. What can be done to protect against XSS if the app calls a third party black box app that has no way to store and ...
1
vote
1answer
59 views

How does XSRF-token per request work? (Angular solution)

I want to protect my application against XSRF. Although I couldn't really understand what the problem is and how my solution works, after some research I came up with a solution, which Angular uses. ...
1
vote
2answers
88 views

Is it possible to make the back button work if we use one CSRF-token per request?

Do we need to compromise on back button navigation if we use one CSRF-token per request instead of one token per session? (I was successful in using one token per session without any navigation ...
1
vote
1answer
243 views

OAuth + Confused Deputy + access token verification + state parameter

Google's "Using OAuth 2.0 for Client-side Application" article at https://developers.google.com/accounts/docs/OAuth2UserAgent states that the client MUST validate all access tokens to verify that it ...
-6
votes
1answer
56 views

Where is the CSRF vulnerability in this Python CGI application? [closed]

I have the following Python code, and I am wondering which line is most likely to expose a CSRF vulnerability. import cgi import Cookie c = Cookie.SimpleCookie() form = cgi.FieldStorage() email = ...
0
votes
2answers
115 views

exploiting CSRF in ajax request via XSS flaw

In an application i am testing, there is a stored XSS flaw. Now, I was testing for CSRF and I constructed an HTML page with a javascript that sends the ajax request (XHR). It caused a pre-flight ...
0
votes
2answers
60 views

Send a CSRF attack with a specific header referrer?

There's any way to bypass a referrer CSRF protection and force www.attacker.com to send a POST request to www.victim.com with the header showing as "referer: https://www.victim.com/"? For example the ...
1
vote
1answer
126 views

CSRF tokens in Single Page Applications (JavaScript/Angular)

I have an AngularJS SPA served by Apache on a cheap web host. All communication to the backend is via Ajax REST calls to an expensive cloud server running Tomcat. How can the REST calls be protected ...
3
votes
2answers
116 views

Is it possible to trick a person into going to a website, and running JavaScript, without them knowing? (no iframes)

My website is W. If you make a GET request to my website, it gives you JavaScript, and if you execute the JS, then you do some action (if you are logged in and have a session cookie). Can someone ...
0
votes
2answers
53 views

How is JSESSIONID determined in this CSRF test?

I'm working on testing CSRF protection for one of our webapps. We have a test case like the following: <!DOCTYPE html> <html> <head> </head> <body> &...
2
votes
2answers
901 views

CSRF Login: can Attacker Login using valid credentials?

Consider the picture below (taken from page 21 here). Is this possible? If so, how can I prevent it?
4
votes
3answers
2k views

GET and POST request vulnerable to CSRF attack?

Are both GET and POST request vulnerable to CSRF? Should we use PUT instead?
2
votes
2answers
360 views

CSRF protection for unauthenticated requests, actions, searches or comments?

I have gone through the example of CSRF funds transfer from a bank where the user is logged in. Similarly I have looked at CSRF in case of email updating. I think I understood it but I am not quite ...
1
vote
3answers
346 views

Need help understanding Windows Authentication mechanism

Even if I enforce HTTPS and use anti-forgery tokens, it seems like Windows Authentication could be inherently insecure because it does not require that the user explicitly passes credentials from the ...
5
votes
5answers
200 views

Should I use CSRF protection for GET requests?

I've seen several blanket statements on the web to the effect that you don't need CSRF protection for GET requests. But many web applications have GET requests that return sensitive data, right? Then ...
6
votes
1answer
284 views

PHP bin2hex vulnerable to timing attack?

I've read in a few places[1][2][3] of the desire to make PHP's bin2hex constant time. In what scenarios would bin2hex be vulnerable to a timing attack? Is this below code for handling a CSRF token ...
2
votes
2answers
403 views

Is a JWT usable as a CSRF token?

I'm in need of a CSRF token, for a certain application that submits a form with POST. Ideally, I'd like to not make a DB call for each submission, to avoid storage and DB traffic & latency. To ...
1
vote
2answers
137 views

Should I use one CSRF token per page or per form?

Is it safe to use one CSRF token per form on my page, ex: <form> <input type="hidden" name="token" vale="<?=$data['login_token'];?>" />" </form> <form> <input ...
5
votes
1answer
885 views

Why CSRF's JS can't read token by GETting html

1) User is logged in bank.com in one tab, where everything is secured by CSRF tokens. Then he opens evil.com in another tab. 2) Javascript in evil.com might try to make a POST request to bank.com/...
2
votes
1answer
144 views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
0
votes
0answers
41 views

Security issue with CSRF token

My website has CSRF vulnerabilities. I have tried to mitigate the risk. Whenever users try to perform CSRF attack, they will be redirected to login page for re-authentication. On top of that, I ...
3
votes
2answers
66 views

Signing Double Submit Cookies, where the value is a pseudo random string and a signature of it. Is this more secure?

I'm not sure if I am describing something that has already been proposed. If not, I would like to coin this "Signed Double Submit Cookies" as a method to improve the Double Submit Cookies technique ...
1
vote
1answer
88 views

Security concerns of HTML echo endpoint

Consider a website with an endpoint that, when a payload of an HTML string (full document or partial segment) is POST to it, the server will transform the payload (and sometimes no transform is ...
2
votes
3answers
3k views

CORS & CSRF Prevention for an REST based API

I'm currently trying to wrap my head around how to prevent CSRF. My first solution was to use a token which is suggested everywhere. That would of course fix this problem: <img src="http://api....
2
votes
2answers
61 views

What can a user do in order to protect against CSRF attacks?

If I'm browsing while I'm logged in into my hosting panel or router or any other application, there is a chance of being hacked by a CSRF exploit. So, the question here is about user or client-side ...
5
votes
2answers
123 views

What to use as 'state' in OAuth2 Authorization Code Grant workflow

I'm using csrf protection in my web app. Now I'm planning to trigger a OAuth2 Authorization Code Grant workflow, starting with a static template opened in a new browser window using window.open(...
1
vote
0answers
44 views

Are Web Services vulnerable to CSRF?

I'm testing an android application, it uses web services for every action, so I saw the requests don't have tokens or another anti-automation mechanism, they just need to validate a token to identify ...
4
votes
2answers
88 views

Why would a modern browser allow internal resources to be loaded from an external page

Recently someone announced that several Arris surfboard models lacked any form of authentication to perform functions such as reboot and factory reset a modem with a single http call. Read more on ...
3
votes
2answers
134 views

Can CSRF protection work even if an XSS vulnerability exists?

Need for CSRF protection that withstands an XSS attack One of the big dangers of XSS is that it can often bypass CSRF protection and thus perform any action the victim can perform. If it would be ...
1
vote
1answer
150 views

Is JWT in cookies with any CSRF solution just as vulnerable to XSS as JWT in localStorage?

I've read that JWT tokens shouldn't be stored in localStroage because XSS attacks can read them. The proposed solution is to store JWT tokens in HTTPOnly cookies and use anti-CSRF w/ double-submit ...
3
votes
1answer
57 views

How does the same-origin-policy protect against PUT/DELETE CSRF?

I've read the OWASP guide for cross-site request forgery and it states that "other HTTP methods", such as PUT and DELETE could be theoretically used for CSRF. However with the same-origin-policy ...
3
votes
2answers
230 views

Are these four HTTP headers protection against Cross-Frame Scripting enough?

I would like to ask a question what is the best protection against Cross-Frame Scripting. I have set up my web server to adding these flags into HTTP HEADER: X-Same-Domain: 1 X-Content-Type-Options: ...
4
votes
3answers
257 views

CSRF expiring before form submitted

I have a very long web form that could take hours for people to complete. The problem with this is when people take too long the CSRF token expires before they're done and when they hit submit they ...
1
vote
1answer
77 views

CSRF Prvention Token Mechanism: Back button Navigation

I have a legacy web application and need to prevent it from CSRF. I tried to resolve the issue without compromising application functionality and got issues related to navigation. The main concern ...
3
votes
3answers
181 views

Mitigating Login CSRF on 3rd party websites

I'm working on a project that requires to have a signup/login functionality exposed to partners who manage their own website. For some of these websites they reuse our own backend, and just change the ...
4
votes
2answers
64 views

Can an attack that does not change the server state be considered a CSRF attack?

From Wikipedia: A real CSRF vulnerability in uTorrent (CVE-2008-6586) exploited the fact that its web console accessible at localhost:8080 allowed mission-critical actions to be executed as a ...
3
votes
1answer
60 views

CSRF on login page

I have a CSRF Token on the login page, which works as expected. So when user has the login page open for a long time (the token has expired in the background). When they enter their login credentials ...
4
votes
2answers
166 views

Why are cookies considered more secure against XSS?

This article discusses storing session tokens in a cookie vs in localStorage: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/ The article states: Cookies, when ...