a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

learn more… | top users | synonyms

0
votes
1answer
17 views

Modern Browsers, Safe to Ignore CSRF?

For users using modern browsers, is it safe to assume they won't be able to be hijacked via CSRF and the likes? If not, how likely is it that an attack can take place?
0
votes
1answer
17 views

CSRF Guard: Injects token in POST Request?

I have implemented CSRF Guard into my web application. It's working fine for GET requests (with AJAX and without AJAX) however for POST request token is not getting injected into the request that's ...
-1
votes
1answer
30 views

Is it some kind of bug, if same request is being used over and over again to perform a particular update? [on hold]

<body> <form action="example.com/deleteuser"> <input type="hidden" name="newid" value="7613053" /> <input type="hidden" name="comment" value="6272321" /> ...
0
votes
1answer
37 views

CSRF Guard - Can it protect service call also?

I'm implementing CSRF guard in my web application. I have done all the required configuration and I can see token getting generated/injected into the request header. Let me tell you application's ...
6
votes
1answer
44 views

When generating CSRF token

I'm building a CSRF prevention method in our application framework. I use, inter alia, the OWASP site. We have chosen for the "Double Submit Cookies" prevention meassure, described at the OWASP CSRF ...
8
votes
1answer
50 views

CSRF in ASP.NET

There's this "change password" ASP.NET form that has both event validation and viewstate enabled. There are no specific anti-csrf tokens. From I understanding, in order to execute a successful CSRF ...
3
votes
3answers
158 views

Why doesn't XSS vulnerability from the site launching the CSRF attack make the Synchronizer Token Pattern insecure?

I was reading this question about using Synchronizer Token Pattern to protect against CSRF and the comments of the answer intrigued me. Of course, as the last comment says, if your site has an XSS ...
6
votes
2answers
2k views

CSRF prevention in PHP

Two questions. Where does one download the PHP version of OWASP's CSRF Guard? The following URL says to check Git: https://www.owasp.org/index.php/PHP_CSRF_Guard All I see on Git however is ...
4
votes
1answer
423 views

Why are CSRF tokens used so often?

CSRF tokens are used a lot. The server sets a token in cookie for that domain that either (1) include in the HTML form or (2) Javascript can read and include in the request. The server verifies the ...
-1
votes
0answers
30 views

How does BREACH attack work [duplicate]

So, I was reading about the security issues in Django websites. There I came to know about BREACH attack, which I have not understood completely. There it says that the attacker guesses the csrf token ...
2
votes
2answers
132 views

Should every post request include csrf token?

What is the vulnerability level if the anti-csrf token is not sent with every post request? (If the vulnerability levels were high, medium and low). I understand for critical functions like login etc ...
1
vote
2answers
75 views

Is it considered a CSRF if it requires a unique identifier which is not a CSRF token - not tied to the user session?

Consider an end point such as below. Let's imagine that this endpoint updates an address of the signed in user, changing the zip code. The address to update is identified by the address ID ...
0
votes
1answer
97 views

Why does this CSRF vulnerability work?

Recently Laravel 4 was updated to address a security concern: there was a CSRF vulnerability in their code. Here's the old code: if (Session::token() != Input::get('_token')) { throw new ...
0
votes
1answer
35 views

The Spring Security framework recommends against using double-submit cookies to prevent CSRF. Is their concern legitimate?

I was about the Spring Security framework's CSRF protection to see how it works. Spring doesn't use the double-submit pattern, but instead associates the CSRF token with the user's session. The ...
2
votes
2answers
114 views

_ _ VIEWSTATE to Protect Against CSRF

I am not a .NET developer and I am trying to understand how exactly does __ViewState protect against CSRF/XSRF attacks. I came across the following : security Stack exchange discussion on similar ...
3
votes
3answers
158 views

How is the same origin policy causing my PoC to fail when I don't need to read return data?

I'm performing an authorized vulnerability analysis on a custom web service and have discovered a CSRF vulnerability. Due to there not being form tokens coupled with the service not checking for the ...
0
votes
1answer
78 views

extracting JSESSIONID from document.cookie

I was trying cookie stealing on a java and spring based web application. Normally, a cookie can be obtained through <script>alert(document.cookie)</script>, but in the above code, cookie ...
5
votes
1answer
1k views

CSRF prevention for RESTful services

Am I right If I claim on that there doesn't exist any reliable protection against CSRF for a stateles environment today? I have a RESTful service (build with RESTEasy) that needs to be secured against ...
1
vote
3answers
96 views

Will checking the CSRF token on the header and the form's hidden be enough?

From what I read here, CSRF tokens from the cookie header cannot be read because of the same-origin policy. Is comparing the CSRF token on the cookie header with the form's hidden element be ...
8
votes
4answers
986 views

Can anti-CSRF token prevent bruteforce attack?

I am not much experienced with brute force attacks but I was wondering Suppose, you have a website www.example.com and you want to do brute force attack on that login form but that login form is ...
1
vote
0answers
58 views

Secure Single Page Application (SPA) served from a CDN

Is it possible to secure a Single Page Application (SPA) served from a CDN that communicates with a REST API, assuming the following: The front end communicates with a backend REST API using a token ...
1
vote
1answer
236 views

how can we find the CSRF vulnerability in a website?

I heard that there are no specific tools available to test and find out the CSRF vulnerability of a website. So from a security testers point of view, how to test for the CSRF vulnerability?
0
votes
1answer
123 views

jquery $.post CSRF protection

How can I protect the following code from CSRF? $.post("lib/newEmployee.php",{employee_id: employee_id, employee_name: employee_name}, function (output){ //code }); ...
2
votes
2answers
594 views

Are HTTPOnly Cookies submitted via XmlHTTPRequest with withCredentials=True?

I have a two part question here. I have a javascript webapp accessing privileged REST endpoints. I would like to protect against CSRF. Currently, I have a login system built which returns a login ...
0
votes
1answer
37 views

May I write the CSRF token to a script

The django docs tell us that our AJAX scripts should acquire the token from the designated cookie as in get_cookie('_csrf_token'). Can I rather print it to the HTML source, so that it's available to ...
0
votes
3answers
54 views

should I give the csrf token a descriptive name?

Personally I want to call the element _DO_NOT_give_this_security_thingy_to_anybody_ever. An example scenario is some clever social engineers want the user to run a malicious "add a friend" and find ...
0
votes
1answer
27 views

recreating CSRF Token after usage [duplicate]

Is it a good practice to recreate the CSRF Token once its been used (basically create a new taken after a post request is sent)? Or it an unnecessary measure to take? My current system is recreating ...
7
votes
2answers
694 views

Does CSRF prevention also prevent reflected XSS attack?

What I understand about reflected XSS is ... When a web application is vulnerable to this type of attack, it will pass unvalidated input sent through requests back to the client... [1] ...
0
votes
1answer
108 views

CSRF vulnerability in CGI/shell script web interface of hardware

I have a web interface to a hardware that is primarily used to reboot the hardware. Reboot can be done only by authenticated user.The web interface is written in CGI/shellscript. It does not use any ...
1
vote
1answer
43 views

Acronym CSRF refer to token or the attack itself?

I am really confused of what CSRF is. I know it stands for Cross-site request forgery. http://en.wikipedia.org/wiki/Csrf When you read it here it talks about cross site request forgery attack. But ...
0
votes
0answers
14 views

csrf best practices [duplicate]

I store the csrf token in a form and compare it against what I have in cache. Sometimes I store the csrf token in cookie and compare it against what I have in cache. I generate new csrf tokens every ...
0
votes
1answer
234 views

Why can Oauth2 redirect_uri be a non-https URI?

I'm building a small site which I would like to integrate with LinkedIn for authentication. LinkedIn says that redirect_uri's can be either http:// or https:// (not having to pay for a certificate is ...
1
vote
4answers
653 views

Configure Firefox against malicious 302 redirect from a embedded image resource?

Today my friend demonstrated such a attack. I am using RenRen, a social networking website in a way very like Facebook in China. And I saw an article he wrote. Actually there is only an "image" ...
3
votes
2answers
176 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
0
votes
2answers
186 views

Security issues in “Remember Me” function code example

I'm a beginner, and these may be very obvious for you, but I'm trying to understand if there are security issues with this example. Today on Stack Overflow, I saw the following post: PHP Sessions ...
4
votes
3answers
3k views

Storing anti-CSRF token in cookie

I generate a random anti-CSRF token per session and store it in a cookie (with the http_only flag set). Then I add that token to forms (in a hidden input field) and links. When receiving a request on ...
17
votes
3answers
818 views

Protecting Health Care Database

I am doing a minor project on information security in which i am implementing techniques listed below to protect a HEALTH CARE database. Preventing SQL Injection (using prepared ...
3
votes
2answers
196 views

Random token and email confirmation key of 10 chars sufficient?

I have a function that returns random unguessable keys with the following characters: a-z A-Z 0-9. I have set the key length to 10 and I am using that for my form tokens to prevent CRSF and I will be ...
5
votes
2answers
663 views

Ajax and CSRF protection

Without going into too much details I have a site which is 100% Ajax. All requests to the site (both GET and POST) are done via Ajax. Now I have to implement CSRF protection, and all the solutions I ...
2
votes
4answers
141 views

Is CSRF possible if I don't even use cookies?

I have REST api that is using access token which is sent either in header or as url query. I don't use cookies at all. Am I still vulnerable to CSRF attacks? I know that I would if I would use ...
2
votes
2answers
483 views

Must login and logout action have CSRF protection?

I am making a web application in Django which generates and includes CSRF tokens for sessions (a Django session can be anonymous or a registered user). Should I keep CSRF protection to the controllers ...
2
votes
3answers
2k views

how an iframe can cause xsrf?

I know how a form tag is prone to CSRF which does not use any token (or any other challenge-response mechanism) but I was wondering how an iFrame can be used to cause XSRF attack and what would be the ...
1
vote
2answers
151 views

Is it safe to skip CSRF checks for non-browsers?

I was in the middle of implementing a CSRF protection mechanism for my server when I realized that this attack only really affects web browsers. It got me wondering: why should I bother ...
2
votes
2answers
188 views

Why does Double Submit Cookies require a separate cookie?

According to https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Double_Submit_Cookies: When a user authenticates to a site, the site should generate a ...
2
votes
1answer
134 views

Why CSRF's JS cant read token by GETting html

1) User is logged in bank.com in one tab, where everything is secured by CSRF tokens. Then he opens evil.com in another tab. 2) Javascript in evil.com might try to make a POST request to ...
11
votes
4answers
1k views

How to protect against login CSRF?

http://seclab.stanford.edu/websec/csrf/csrf.pdf points out that most CSRF protection mechanisms fail to protect login forms. As http://stackoverflow.com/a/15350123/14731 explains: The ...
16
votes
4answers
7k views

CSRF protection with custom headers (and without validating token)

For a REST-api it seems that it is sufficient to check the presence of a custom header to protect against CSRF attacks, e.g. client sends "X-Requested-By: whatever" and the server checks the ...
6
votes
2answers
3k views

CSRF protection and Single Page Apps

I am in the process of writing a thick client web app using Angular.js (single page app) and was wondering what are the best practices for securing the app using a CSRF token. Should I send a CSRF ...
1
vote
1answer
105 views

Github Pages Security, From .com to .io

Github pages is now using github.io domain instead of github.com I've read github explanation but it's still difficult for me to understand the root cause. Why would a domain become a security issue? ...
15
votes
3answers
609 views

Why CSRF Token has to be a Cryptographically Strong Random number, in Double Submit Cookies method?

I was just going through the OWASP's Cheat Sheet for CSRF Prevention. In the Double Submit Cookies method, I saw this the site should generate a (cryptographically strong) pseudorandom value ...