a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

learn more… | top users | synonyms

0
votes
1answer
145 views

Does a malicious android WebView break the DoubleSubmittCookie countermeasure against CSRF?

Initial situation: A RESTful webservice defends against CSRF attacks by using the double submit cookie approach. This means that the authentication token gets submitted twice and verified at the ...
3
votes
1answer
449 views

With BREACH attack, is session-based CSRF token still secure?

This is something I haven't been able wrap my head around, if BREACH allow leaking of information, do we have to mask or generate CSRF token in a time-based or per-request fashion to make it more ...
14
votes
2answers
28k views

Why is the Access-Control-Allow-Origin header necessary?

I understand the purpose of the Access-Control-Allow-Credentials header, but can't see what problem the Access-Control-Allow-Origin header solves. More precisely, it's easy to see how, if ...
3
votes
2answers
134 views

Why doesn't XSS vulnerability from the site launching the CSRF attack make the Synchronizer Token Pattern insecure?

I was reading this question about using Synchronizer Token Pattern to protect against CSRF and the comments of the answer intrigued me. Of course, as the last comment says, if your site has an XSS ...
1
vote
3answers
2k views

How to share CSRF token to client application?

I have two different web application. Services web app has REST Services defined. Client web app has JSP pages which makes call to REST services using Ajax to get the data and display in the UI. I ...
6
votes
2answers
762 views

Are RESTful sites safe against CSRF attacks?

I am having a debate with a coworker about whether our site is vulnerable to CSRF attacks. He is saying that since we are using RESTful AJAX requests for everything that CSRF is not possible. Say a ...
4
votes
1answer
303 views

CSRF and Flash/Flex

Flash and Flex clients can make RPC calls to a server using the NetConnection and AMF protocols. It's not uncommon to have these RPC calls setup to authenticate based on a cookie. I've heard ...
4
votes
1answer
740 views

CSRF prevention for RESTful services

Am I right If I claim on that there doesn't exist any reliable protection against CSRF for a stateles environment today? I have a RESTful service (build with RESTEasy) that needs to be secured against ...
0
votes
3answers
325 views

CSRF possible if params are not passed through query string?

I was reading up on OWASP's page on CSRF and in their example they use a request where the sensitive parameters are stored in the query string: ...
1
vote
1answer
434 views

Why is Access-Control-Allow-Origin required for uncredentialed cross-domain requests?

I understand CSRF and why cross-domain AJAX requests with cookies or other credentials can't be permitted without an Access-Control-Allow-Credentials header explicitly permitting them - otherwise I'd ...
1
vote
4answers
523 views

Configure Firefox against malicious 302 redirect from a embedded image resource?

Today my friend demonstrated such a attack. I am using RenRen, a social networking website in a way very like Facebook in China. And I saw an article he wrote. Actually there is only an "image" ...
-2
votes
2answers
236 views

Parameterization strategy for hazardous character injection [closed]

I have a input text field for accepting Email ID. If Email ID is not entered by User, I have a client side validation using Java Script to display error message which reads like, "Please enter valid ...
4
votes
3answers
132 views

Does CSRF work when the target site is not open on a tab?

This is an example attack scenario of OWASP for CSRF The application allows a user to submit a state changing request that does not include anything secret. For example: ...
1
vote
2answers
621 views

Generating session CSRF token based on SSL session ID

Following situation: Application is only accessible via HTTPS/SPDY nginx is sending the SSL session ID to the upstream server Upon session start I'd like to use the first 128 characters of that ...
1
vote
2answers
364 views

CSRF protection with cookie and AJAX

I would like to note that I've read the other question with an embarrassingly similar title and it does not contain an answer to my question. I have not used CodeIgniter as a programmer, but I have ...
8
votes
3answers
1k views

CSRF Token in GET request

According to the OWASP testing guide a CSRF token should not be contained within a GET request as the token itself might be logged in various places such as logs or because of the risk of shoulder ...
6
votes
2answers
3k views

CSRF protection and Single Page Apps

I am in the process of writing a thick client web app using Angular.js (single page app) and was wondering what are the best practices for securing the app using a CSRF token. Should I send a CSRF ...
3
votes
1answer
302 views

Do websocket-powered web apps (e.g. “comet” apps) have to worry about CSRF?

The standard advice for HTTP applications wanting to prevent Cross Site Request Forgery is to include a random token on each state-changing request (usually POST) which is verified by the server ...
2
votes
2answers
137 views

Is it safer to store the XSRF value inside your JavaScript?

To protect yourself against XSRF, you need to have a separate token on a page. See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood As the posting suggests, its best to have those ...
5
votes
3answers
358 views

Are CSRF Attacks Really Blind

I'm new to CSRF attacks but don't see how they are always blind. Let's say we are dealing with a site where the asset we need to protect is the HTTP response. Something like one's medical history. ...
10
votes
5answers
1k views

CSRF protection with Session Id

To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent? The server would then just ...
8
votes
2answers
840 views

Type 2 XSS vs CSRF

Trying to create a thorough understanding of XSS and CSRF, i'm clear that a type 2 xss involves an exploit that is persistent on the server. e.g. <SCRIPT type="text/javascript"> new ...
4
votes
2answers
480 views

How Secure are Authenticity Token in Rails

I came across a website which uses Rails Authenticity token to prevent CSRF attacks. My concern here is that I can see the authenticity token in the source code of the web page. If any other service ...
7
votes
3answers
342 views

What are the risk implications of not verifying referer header on login form?

Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to ...
5
votes
1answer
160 views

CSRF protection - 'back pages'

OWASP suggests that when implementing CSRF protection any attempt to go 'Back' in the browser will cause issues as Interaction with this previous page will result in a CSRF false positive security ...
12
votes
2answers
293 views

Why do browsers allow public websites to attack intranet sites?

When I'm visiting a website on the public internet, the website can cause my browser to send requests to a local IP address (such as 10.0.0.1). This can be used to attack internal web sites, e.g., ...
1
vote
1answer
1k views

Anti-CSRF mechanism with referer header

This is not my main anti-CSRF mechanism; I know that https requests don't have a referer header; I know users or firewalls can remove it or set to an arbitrary fixed value. I intend this mechanism ...
4
votes
3answers
2k views

Storing anti-CSRF token in cookie

I generate a random anti-CSRF token per session and store it in a cookie (with the http_only flag set). Then I add that token to forms (in a hidden input field) and links. When receiving a request on ...
1
vote
1answer
764 views

CSRF with OAuth or Bearer Authorization headers

I am designing a RESTful API which is to be accessible from a web browser. The API is protected by Basic authentication. I understand the concept of CSRF, and the mitigations proposed (I found both ...
2
votes
2answers
493 views

CSRF Login: can Attacker Login using valid credentials?

Considering this picture: taken from here:page21 Is this possible? If so, How to prevent it?
0
votes
1answer
176 views

CSRF mitigation in MVC

I'm wondering about the best way to protect against CSRF in MVC or any other stateless web app. Due to the stateless nature, we can not keep a secret token in the session and compare it to the secret ...
4
votes
1answer
602 views

CodeIgniter CSRF confusion

I have been working with CodeIgniter for about 3 weeks and am very well on the way to loving this framework. However I have been looking at the core code of the framework and I was reading over the ...
0
votes
1answer
471 views

Cookies + CSRF protection + AJAX

In my app (built in Codeigniter), users can submit status updates. When submitting forms, Codeigniter automatically provides a hidden cookie. I can validate that cookie through AJAX when the user ...
3
votes
3answers
1k views

How about preventing CSRF this way?

According to Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet , the recommended solution to protect web site from CSRF attacking is to implement Synchronizer Token Pattern. And This requires ...
23
votes
1answer
4k views

Is Django's built-in security enough?

I have learned that Django provides built-in protection against the three main types of web app attacks (SQL injection, XSS and CSRF), which is really awesome. Yet I have spoken to a few Django ...
5
votes
3answers
888 views

CSRF Countermeasures

I'm working through a book on web application security and it says that an effective CSRF countermeasure is to assign a temporary pseudo-random token to sensitive actions performed by authenticated ...
3
votes
1answer
478 views

Is one CSRF token per session is adequate with HTTPS?

Ours is a Ajax heavy application with concurrent Ajax requests. Generating unique tokens with each request or expire and creation of new tokens after a certain interval could get tricky with multiple ...
3
votes
1answer
2k views

How does a CSRF token prevent an attack, and how can I safely use/avoid it for my JSON API?

I'm trying to make an iOS app communicate with a Ruby on Rails website using JSON. While trying to post a login to create a user session, I discovered I was missing a CSRF token. I had no idea what ...
3
votes
1answer
239 views

How did the Tumblr worm spread?

Recently Tumblr was hit by a fast-spreading worm. How did the worm work? What was the vulnerability in Tumblr that it exploired? Did it exploit a XSS vulnerability in Tumblr? A CSRF vulnerability ...
0
votes
3answers
118 views

Does AV software protect web applications (Twitter, Facebook, etc) from attacks? (CSRF, etc)

Is it correct to say that AV software focuses on downloaded executables and locally malicious activity, and it doesn't actively scan HTTP/S content for web based attacks such as CSRF, XSS, phishing ...
1
vote
2answers
209 views

Is there guidance that says all sessions to be logged off when a user changes their password?

Often when an account is hacked, security guidance is to change your password. However I've noticed that changing a password sometimes isn't enough to log out of other sessions that are active. Is ...
5
votes
2answers
804 views

CSRF protection for AJAX when using multiple browser tabs

Say I've got that web application that has a CSRF protection according to the Synchronizer Token Pattern. The server expects a valid CSRF token in each POST request when the user is authenticated. Now ...
14
votes
4answers
5k views

CSRF protection with custom headers (and without validating token)

For a REST-api it seems that it is sufficient to check the presence of a custom header to protect against CSRF attacks, e.g. client sends "X-Requested-By: whatever" and the server checks the ...
4
votes
2answers
497 views

CSRF Protection on static pages

I have a static site which has forms. The forms submit to a Rails endpoint which captures the submitted data. The static site and the Rails endpoint are on the same domain, on different subdomains and ...
0
votes
2answers
743 views

CSRF over post request without redirection?

Is there a way to forge post request without being redirected to the page where parameters are submitted.For example : <html> <head> <title> CRSF example </title> ...
14
votes
4answers
6k views

Why refresh CSRF token per form request?

In many tutorials and guides I see that an CSRF token should be refreshed per request, my question is why do I have to do this? Isn't a single CSRF token per session much easier than regenerating one ...
3
votes
1answer
413 views

Burpsuite Pro: CSRF tokens in sequencer

So I'm using Burp to try and estimate the entropy used by tokens to prevent CSRF. Let's say a website has a url in it's site protected by a Token: <a ...
5
votes
2answers
538 views

Ajax and CSRF protection

Without going into too much details I have a site which is 100% Ajax. All requests to the site (both GET and POST) are done via Ajax. Now I have to implement CSRF protection, and all the solutions I ...
9
votes
2answers
3k views

OAuth2 Cross Site Request Forgery, and state parameter

http://tools.ietf.org/html/draft-ietf-oauth-v2-30#section-10.12 says: The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the redirection URI ...
5
votes
4answers
1k views

Protecting against CSRF when a form is being submitted via an AJAX call

I'm using anti-CSRF tokens on all my forms to prevent CSRF attacks. Also, the tokens are being saved in the $_COOKIE variable to validate against the value I get from the form. I'm resetting the token ...