a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.
6
votes
2answers
192 views
Presentation on Web App Security (ACM Student Chapter)
I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding ...
1
vote
2answers
520 views
how an iframe can cause xsrf?
I know how a form tag is prone to CSRF which does not use any token (or any other challenge-response mechanism) but I was wondering how an iFrame can be used to cause XSRF attack and what would be the ...
3
votes
1answer
256 views
OpenID Session Fixation with CSRF
This answer describes a situation where CSRF can be used to trick an end user to enter a credit card into another person's Paypal account. It also highlights the fact that state-changing GET requests ...
7
votes
3answers
3k views
Does ASP.NET Viewstate implicitly prevent CSRF attacks? What does this mean for MVC?
If an encrypted ASP.NET Viewstate is submitted with every form, and control POST, does that mean that ASP.NET is less vulnerable to CSRF than other solutions with this?
What is the extent and ...
7
votes
4answers
1k views
CSRF protection needed for clients that don't accept cookies?
I have recently updated a website from Django 1.0 to 1.3. One of the changes introduced was automatic protection against CSRF attacks. For the most part, this works great, but I have a problem with ...
6
votes
3answers
604 views
How should a web page respond to a CSRF attack?
I know that you use tokens to prevent CSRF, but how should the receiving page respond when it is attacked? Should it fail silently, pretending the transaction was successful? Display an error message? ...
6
votes
7answers
534 views
Should I prevent sending of GET requests for urls that are normally operated with POST request?
There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
-3
votes
2answers
382 views
Web service that converts HTTP GET to POST?
Is there some online forwarding service that I can give HTTP GET parameters to, and it would create a form with the parameters and submit it as POST?
For example, I'd like to give someone the URL:
...
5
votes
2answers
362 views
What is more secure: Many subdirectories, or many subdomains?
I have 3 websites that could be configured as a "VirtualApplication" in servicedefinition.csdef:
www.mydomain.net/enroll
www.mydomain.net/admin
www.mydomain.net/
... or I can configure them as a ...
3
votes
2answers
657 views
When should I not use CSRF protection for a form?
By default, I have CSRF protection for all my forms using a token.
However I noticed another web application that has a similar function to one of my forms. ANd they did not use CSRF token.
So I ...
1
vote
2answers
122 views
I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine?
I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine?
Edit
Assume the web server has CSRF vulnerability. No hidden token checking ...
15
votes
2answers
2k views
When the use of a AntiForgeryToken is not required /needed?
I'm running a rather large site with thousands of visits every day, and a rather large userbase.
Since I started migrating to MVC 3, I've been putting the AntiForgeryToken in a number of forms, that ...
12
votes
2answers
1k views
How to do Ajax securely?
This question is inspired by this security question http://security.stackexchange.com/questions/1707
What are the threats in using Ajax? (Please note I am talking about security threats, not ...
1
vote
2answers
1k views
Should CSRF 'Double Submit Cookie' technique have a different seed value for the cookie versus the HTTP POST?
I'm reading about the OWASP double submit cookies method of protection and there it states that the cookie value between the header and form should match.
That seems to be somewhat of a risk, as the ...
4
votes
1answer
219 views
What are the implementation details and rationale of ASP.NET MVC3's AntiForgeryToken?
The AntiForgeryToken is used to prevent CSRF attacks, however the links on MSDN don't give me much insight to what exactly the AntiForgeryToken does, or how it works, or why things are done the way ...
4
votes
2answers
1k views
Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation
I'm hesitant to implement the proposed anti-JSON hijacking solutions since
The recommended solutions to mitigating JSON hijacking involve non-REST-full JSON POSTs to GET data
The alternate ...
3
votes
3answers
269 views
Protecting websites from outdated browsers and plugins via a whitelist/blacklist combination?
Aside from using browser headers, I want to blacklist/whitelist browser and plugins from my site so that I can prevent these older unpatched systems from (1) being a general user of my site (2) ...
4
votes
1answer
446 views
How to prevent CSRF if you want to include Flash plugins in your form like Uploadify in your form?
What is CSRF?
I need a basic definition that is not just lifted from Wikipedia.
I understand SQL injection, XSS, cookie poisoning, but I just cannot wrap my mind around this.
I am using a ...
11
votes
4answers
4k views
What is the correct way to implement anti-CSRF form tokens?
I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet.
I've created tokens as a md5 of username, form info and a salt and stored it ...
