a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

learn more… | top users | synonyms

1
vote
3answers
61 views

Is there any danger from CSRF if a webservice doesn't impact server data?

I've been reading about CSRF and how it works, and, if I understood correctly, the 'only' thing an attacker can do is force the user to perform actions he didn't intend. I understand the danger if ...
5
votes
2answers
122 views

What to use as 'state' in OAuth2 Authorization Code Grant workflow

I'm using csrf protection in my web app. Now I'm planning to trigger a OAuth2 Authorization Code Grant workflow, starting with a static template opened in a new browser window using window.open(...
2
votes
0answers
24 views

Why has the “Origin” HTTP header not been universally adopted? [duplicate]

After running tests on a few browsers on browserscope.org, I noted that neither Firefox or IE have adopted the "Origin" HTTP header. This header is a useful and valid way of helping prevent CSRF ...
1
vote
0answers
25 views

CSRF attack - Set custom CSRF Header [duplicate]

The title is a little bit unclear but I had no idea to describe the following issue in there. I found a vulnerability in a website where I am able to bypass the CSRF protection (Bug Bounty program...)...
3
votes
0answers
96 views

How does github.com implement CSRF mitigation

I had a look into CSRF recently. The recommended mitigation strategy is to implement the Synchronizer Token Pattern. When you look at the details, the question comes up how often these tokens need to ...
0
votes
0answers
33 views

XSS script syntax problem

I have a server running on port 4444 on localhost that just echoes messages it receives. I have a JS script embedded in a message that is supposed to send the cookies of whoever looks at it. Here ...
5
votes
4answers
133 views

How does a CSRF logout pose a potential threat to a website?

Websites like SuperLogout logs the user out from several websites at one go. I want to know in what way does this pose a potential threat to the users of the website? How can this be combined with a ...
2
votes
0answers
91 views

Is it secure to use one CSRF token multiple times?

I am new to the CSRF problem and I am studying how CSRF protection is implemented in popular applications like Facebook, Instagram etc. Now I am studying how CSRF protection is used in OAuth ...
1
vote
3answers
338 views

Need help understanding Windows Authentication mechanism

Even if I enforce HTTPS and use anti-forgery tokens, it seems like Windows Authentication could be inherently insecure because it does not require that the user explicitly passes credentials from the ...
2
votes
0answers
205 views

Astonishing Recent Belkin Router Auth Bypass Vulnerability: CSRF Used to Exploit?

I was visiting the CERT site main page today for another reason when I glanced at the list of recent vulnerability bulletins and came across some news I had somehow missed before today: a notice that ...
1
vote
2answers
218 views

CSRF by manipulating HTTP headers from client side using JavaScript

I am trying to do CSRF vulnerability analysis for my website. My website uses an anti-CSRF-token which is sent by the server to the client with the session cookie and then Javascript in the client ...
3
votes
2answers
227 views

Are these four HTTP headers protection against Cross-Frame Scripting enough?

I would like to ask a question what is the best protection against Cross-Frame Scripting. I have set up my web server to adding these flags into HTTP HEADER: X-Same-Domain: 1 X-Content-Type-Options: ...
1
vote
2answers
302 views

Should I invest my time in making my site HTTPS-only?

I'm building a Django website that does not need to have registration/authentication. The only sensitive part is a form with a reCaptcha v2. Of course I'm embedding the CSRF token, which then I read ...
0
votes
1answer
82 views

Does custom header for CSRF protection invalidate CSRF protection

A penetration testing is ordered on one of the web sites. I have implemented OWASP CSRF Guard on the web site. It uses custom headers for CSRF protection for AJAX. This got flagged with subject ...
0
votes
1answer
161 views

Is sharing a CSRF token between Rails apps secure?

We use an nginx reverse proxy to host two Rails apps under the same domain (one /path leads to another 'secondary' app). The 'secondary' app that lives under a path consumes REST APIs from the 'main' ...
5
votes
4answers
157 views

Is it worth checking the referrer?

I have researching CSRF and one thing on the list, I feel is questionable. I am not sure if "checking the referrer" is worth doing or not. Some articles I read, are saying something of this nature:...
-3
votes
1answer
169 views

Does anti-CSRF token really protect from CSRF? [duplicate]

I have been reading all over the internet that I should have CSRF token on my page and this will protect it from CSRF. However, I can imagine a scenario where anti-CSRF is not helpful. Is my ...
2
votes
2answers
291 views

Will Wordpress nonces protect against Login CSRF?

Can Wordpress Nonces be used to protect against Login CSRF? https://codex.wordpress.org/WordPress_Nonces I glanced through the code for the function and it seems to only be using the User ID for ...
3
votes
1answer
663 views

Why is referer checking needed for Django to prevent CSRF

Today I learned that Django's CSRF protection uses refer(r)er header checking in addition to checking a hidden form field against a cookie. It seems to be important, judging from docs and issue below. ...
2
votes
4answers
421 views

about CSRF on form submit [duplicate]

I'm surely missing something in the picture of how CSRF attacks and protections are working. My understanding in a form-submit scenery is the protection rely on a unpredictable token, someway is ...
11
votes
1answer
821 views

Why can't you steal the synchroniser token to do CSRF? [duplicate]

I'm reading up on CSRF and I came across synchroniser tokens. I don't understand why you can't do a CSRF to get the token to do a real CSRF. Example: bank.com has a form like this at https://bank.com/...
3
votes
2answers
157 views

Is this an appropriate anti-CSRF method?

I have the following system in place on my web app and I'd like to know if it's secure. Cookie contains CSRF token. Application detects CSRF token in cookie. Application places token in a header. ...
1
vote
0answers
61 views

Is it okay to add CSRF synchronized token by modifying HTML from a valve/filter?

Is it okay to modify the html and add a hidden field containing the CSRF token to all the forms inside a page using a valve or a filter before going to the browser? I'm thinking on this line since I ...
1
vote
1answer
133 views

Handling CSRF tokens on pages longer than the PHP session limit

I have a page that is open (i.e. requires no login) and allows users to give quick feedback. This page is available on a single shared PC or tablet. The form itself has a CSRF token on it. Problem is ...
4
votes
3answers
244 views

CSRF expiring before form submitted

I have a very long web form that could take hours for people to complete. The problem with this is when people take too long the CSRF token expires before they're done and when they hit submit they ...
1
vote
0answers
37 views

Is it necessary to add CSRF tokens for REST API? [duplicate]

I have a few REST APIs for an iPhone app. It has a login and session management functionality. Currently the session has been tracked by a token set during login. Are REST services affected by CSRF ...
6
votes
1answer
283 views

PHP bin2hex vulnerable to timing attack?

I've read in a few places[1][2][3] of the desire to make PHP's bin2hex constant time. In what scenarios would bin2hex be vulnerable to a timing attack? Is this below code for handling a CSRF token ...
1
vote
1answer
42 views

how to test for csrf if the web application is not using tokens and there are no users defined for that application?

I am testing an application that doesn't use anti-csrf tokens for its requests. There are no users defined for this application as well. Well, in that case, how to carry out testing for csrf in this ...
5
votes
3answers
992 views

Is it secure not to have csrf protection in login forms?

I have noticed that WordPress doesn't have csrf protection for their admin panel login /wp-admin/. Does it actually posses any potential risk? Is there any possible ways there an attacker could ...
10
votes
3answers
1k views

Why is the synchronizer token pattern preferred over the origin header check to prevent CSRF

I am well aware of the concept of CSRF, and I think I am also aware of the possible protection possibilities, as described by OWASP. However, I'm not sure why the synchronizer pattern seems to be ...
0
votes
1answer
526 views

How to check the origin header server-wide in IIS to prevent CSRF

Whereas I'm aware that the synchronizer pattern is the recommended approach to prevent CSRF attacks, I am in a situation where it would be a lot faster to implement the origin header check. I was ...
2
votes
3answers
3k views

CORS & CSRF Prevention for an REST based API

I'm currently trying to wrap my head around how to prevent CSRF. My first solution was to use a token which is suggested everywhere. That would of course fix this problem: <img src="http://api....
5
votes
2answers
2k views

Are phone apps vulnerable to XSS or CSRF? (Webview, Phonegap, chrometab)

I need to provide evidence that CSRF or XSS is possible on a phone... using PhoneGap, a Webview, or specifically a "Chrome Tab" or iOS equivalent. I believe in theory this is possible, and mitigation ...
0
votes
4answers
185 views

Custom CSRF protection mechanism without persisting tokens

I have had this functionality (csrf protection) for quite some time now. The thing I never liked about it is that it saved csrf tokens in the session file. While it may not be a real problem I see it ...
4
votes
3answers
2k views

GET and POST request vulnerable to CSRF attack?

Are both GET and POST request vulnerable to CSRF? Should we use PUT instead?
0
votes
1answer
205 views

What factors make Android app code vulnerable to Cross-Site Request Forgery attacks?

According to techtarget.com Cross-Site Request Forgery is: a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. An XSRF attack can be used to ...
1
vote
1answer
193 views

How to test for CSRF if there are many hidden fields with different values?

Wanted to test specific hidden fields with different values for each with test case of cross site request forgery. How would one do so? Both manual and an automated approach would do. Exclusion ...
0
votes
2answers
136 views

Is injecting a second Authenticity_Token on a login request considered a security threat?

I'm running a security test on a website. The login request looks like this: POST /sessions HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/...
2
votes
2answers
282 views

Usability and CSRF tokens

In a lot of different products the CSRF token is stored in a session. Which means that if the session has expired then the next form submit will fail. Example scenario: you open a login form, the ...
2
votes
2answers
199 views

Can postMessage be used to forward data to hacker's iframe in CSRF attack?

Consider a user that has an open session to a legitimate site with a password on it. This page has no anti-CSRF token. A hacker creates a webpage with 2 hidden iframes. One iframe does a GET on the ...
2
votes
2answers
354 views

CSRF protection for unauthenticated requests, actions, searches or comments?

I have gone through the example of CSRF funds transfer from a bank where the user is logged in. Similarly I have looked at CSRF in case of email updating. I think I understood it but I am not quite ...
1
vote
0answers
192 views

Oauth authentication without state parameter

I have some security concerns about the first step of account authentication in my application. The authentication goes through an OpenID provider. If the response of such provider shows that the ...
1
vote
0answers
268 views

Is there a security vulnerability to permit all CORS origins if the request origin matches a pattern?

Originally asked at: http://stackoverflow.com/questions/29526990/is-there-a-security-vulnerability-to-permit-all-cors-origins-if-the-request-orig We had a requirement to permit cross-origin requests ...
2
votes
1answer
1k views

How to bypass XMLHttpRequest header protection for a CSRF attack

A client is only submitting forms using XMLHttpRequest with the use of a header (X-Header: [any value would be correct]) to protect against Cross Site Request Forgery attacks. I know this is not the ...
2
votes
1answer
1k views

Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?

Here is a test case from a recent application security asessment which I have had experienced: cookie = new Cookie(strKey1, EncryptDecrypt.encrypt(strValue)); cookie.setMaxAge(-1); cookie.setDomain(...
3
votes
1answer
1k views

How to fix open redirect vulnerability?

In redir.php: header("Location: {$_GET['addr']}"); For fixing open redirect vulnerability i can think of several ways: 1- (Side effect of) Using a security token (anti-csrf token): if(!isset($...
0
votes
1answer
444 views

CSRF on GWT apps : bypassing the Same-Origin policy

At work we suspect a GWT app (that is not in production yet) we own to be vulnerable to CSRF. We have to look at it from a black-box point of view before a third-party security audit will be performed....
1
vote
2answers
1k views

CSRF Encrypted-Token pattern protection implementation

I'm implementing CSRF protection using the Encrypted Token Pattern (as per https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet#Encrypted_Token_Pattern). I ...
2
votes
1answer
227 views

Can you steal session cookie with BREACH attack?

Most of the discussions about the BREACH vulnerability are around stealing session-based CSRF tokens. But if you can steal a session-based token, could you also steal the session token itself? ...
0
votes
2answers
364 views

Are CSRF tokens useful outside of web APIs?

I'm trying to understand CSRF tokens and one thing isn't making sense to me. For a web API, you can provide a CSRF token just once, on authentication, and expect the client to remember that token (...