a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

learn more… | top users | synonyms

3
votes
4answers
80 views

How is the same origin policy causing my PoC to fail when I don't need to read return data?

I'm performing an authorized vulnerability analysis on a custom web service and have discovered a CSRF vulnerability. Due to there not being form tokens coupled with the service not checking for the ...
0
votes
1answer
21 views

extracting JSESSIONID from document.cookie

I was trying cookie stealing on a java and spring based web application. Normally, a cookie can be obtained through <script>alert(document.cookie)</script>, but in the above code, cookie ...
4
votes
1answer
950 views

CSRF prevention for RESTful services

Am I right If I claim on that there doesn't exist any reliable protection against CSRF for a stateles environment today? I have a RESTful service (build with RESTEasy) that needs to be secured against ...
1
vote
3answers
74 views

Will checking the CSRF token on the header and the form's hidden be enough?

From what I read here, CSRF tokens from the cookie header cannot be read because of the same-origin policy. Is comparing the CSRF token on the cookie header with the form's hidden element be ...
8
votes
4answers
770 views

Can anti-CSRF token prevent bruteforce attack?

I am not much experienced with brute force attacks but I was wondering Suppose, you have a website www.example.com and you want to do brute force attack on that login form but that login form is ...
1
vote
0answers
30 views

Secure Single Page Application (SPA) served from a CDN

Is it possible to secure a Single Page Application (SPA) served from a CDN that communicates with a REST API, assuming the following: The front end communicates with a backend REST API using a token ...
1
vote
1answer
103 views

how can we find the CSRF vulnerability in a website?

I heard that there are no specific tools available to test and find out the CSRF vulnerability of a website. So from a security testers point of view, how to test for the CSRF vulnerability?
0
votes
1answer
58 views

jquery $.post CSRF protection

How can I protect the following code from CSRF? $.post("lib/newEmployee.php",{employee_id: employee_id, employee_name: employee_name}, function (output){ //code }); ...
2
votes
2answers
440 views

Are HTTPOnly Cookies submitted via XmlHTTPRequest with withCredentials=True?

I have a two part question here. I have a javascript webapp accessing privileged REST endpoints. I would like to protect against CSRF. Currently, I have a login system built which returns a login ...
0
votes
1answer
32 views

May I write the CSRF token to a script

The django docs tell us that our AJAX scripts should acquire the token from the designated cookie as in get_cookie('_csrf_token'). Can I rather print it to the HTML source, so that it's available to ...
0
votes
3answers
51 views

should I give the csrf token a descriptive name?

Personally I want to call the element _DO_NOT_give_this_security_thingy_to_anybody_ever. An example scenario is some clever social engineers want the user to run a malicious "add a friend" and find ...
0
votes
1answer
24 views

recreating CSRF Token after usage [duplicate]

Is it a good practice to recreate the CSRF Token once its been used (basically create a new taken after a post request is sent)? Or it an unnecessary measure to take? My current system is recreating ...
1
vote
2answers
89 views

Should every post request include csrf token?

What is the vulnerability level if the anti-csrf token is not sent with every post request? (If the vulnerability levels were high, medium and low). I understand for critical functions like login etc ...
7
votes
2answers
610 views

Does CSRF prevention also prevent reflected XSS attack?

What I understand about reflected XSS is ... When a web application is vulnerable to this type of attack, it will pass unvalidated input sent through requests back to the client... [1] ...
0
votes
1answer
97 views

CSRF vulnerability in CGI/shell script web interface of hardware

I have a web interface to a hardware that is primarily used to reboot the hardware. Reboot can be done only by authenticated user.The web interface is written in CGI/shellscript. It does not use any ...
1
vote
1answer
40 views

Acronym CSRF refer to token or the attack itself?

I am really confused of what CSRF is. I know it stands for Cross-site request forgery. http://en.wikipedia.org/wiki/Csrf When you read it here it talks about cross site request forgery attack. But ...
0
votes
0answers
14 views

csrf best practices [duplicate]

I store the csrf token in a form and compare it against what I have in cache. Sometimes I store the csrf token in cookie and compare it against what I have in cache. I generate new csrf tokens every ...
0
votes
1answer
113 views

Why can Oauth2 redirect_uri be a non-https URI?

I'm building a small site which I would like to integrate with LinkedIn for authentication. LinkedIn says that redirect_uri's can be either http:// or https:// (not having to pay for a certificate is ...
1
vote
4answers
590 views

Configure Firefox against malicious 302 redirect from a embedded image resource?

Today my friend demonstrated such a attack. I am using RenRen, a social networking website in a way very like Facebook in China. And I saw an article he wrote. Actually there is only an "image" ...
3
votes
2answers
152 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
0
votes
2answers
126 views

Security issues in “Remember Me” function code example

I'm a beginner, and these may be very obvious for you, but I'm trying to understand if there are security issues with this example. Today on Stack Overflow, I saw the following post: PHP Sessions ...
4
votes
3answers
3k views

Storing anti-CSRF token in cookie

I generate a random anti-CSRF token per session and store it in a cookie (with the http_only flag set). Then I add that token to forms (in a hidden input field) and links. When receiving a request on ...
17
votes
3answers
802 views

Protecting Health Care Database

I am doing a minor project on information security in which i am implementing techniques listed below to protect a HEALTH CARE database. Preventing SQL Injection (using prepared ...
3
votes
2answers
169 views

Random token and email confirmation key of 10 chars sufficient?

I have a function that returns random unguessable keys with the following characters: a-z A-Z 0-9. I have set the key length to 10 and I am using that for my form tokens to prevent CRSF and I will be ...
5
votes
2answers
594 views

Ajax and CSRF protection

Without going into too much details I have a site which is 100% Ajax. All requests to the site (both GET and POST) are done via Ajax. Now I have to implement CSRF protection, and all the solutions I ...
2
votes
4answers
133 views

Is CSRF possible if I don't even use cookies?

I have REST api that is using access token which is sent either in header or as url query. I don't use cookies at all. Am I still vulnerable to CSRF attacks? I know that I would if I would use ...
1
vote
2answers
215 views

Must login and logout action have CSRF protection?

I am making a web application in Django which generates and includes CSRF tokens for sessions (a Django session can be anonymous or a registered user). Should I keep CSRF protection to the controllers ...
2
votes
3answers
1k views

how an iframe can cause xsrf?

I know how a form tag is prone to CSRF which does not use any token (or any other challenge-response mechanism) but I was wondering how an iFrame can be used to cause XSRF attack and what would be the ...
1
vote
2answers
133 views

Is it safe to skip CSRF checks for non-browsers?

I was in the middle of implementing a CSRF protection mechanism for my server when I realized that this attack only really affects web browsers. It got me wondering: why should I bother ...
2
votes
2answers
107 views

Why does Double Submit Cookies require a separate cookie?

According to https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Double_Submit_Cookies: When a user authenticates to a site, the site should generate a ...
2
votes
1answer
77 views

Why CSRF's JS cant read token by GETting html

1) User is logged in bank.com in one tab, where everything is secured by CSRF tokens. Then he opens evil.com in another tab. 2) Javascript in evil.com might try to make a POST request to ...
11
votes
4answers
690 views

How to protect against login CSRF?

http://seclab.stanford.edu/websec/csrf/csrf.pdf points out that most CSRF protection mechanisms fail to protect login forms. As http://stackoverflow.com/a/15350123/14731 explains: The ...
16
votes
4answers
6k views

CSRF protection with custom headers (and without validating token)

For a REST-api it seems that it is sufficient to check the presence of a custom header to protect against CSRF attacks, e.g. client sends "X-Requested-By: whatever" and the server checks the ...
6
votes
2answers
3k views

CSRF protection and Single Page Apps

I am in the process of writing a thick client web app using Angular.js (single page app) and was wondering what are the best practices for securing the app using a CSRF token. Should I send a CSRF ...
1
vote
1answer
95 views

Github Pages Security, From .com to .io

Github pages is now using github.io domain instead of github.com I've read github explanation but it's still difficult for me to understand the root cause. Why would a domain become a security issue? ...
14
votes
3answers
536 views

Why CSRF Token has to be a Cryptographically Strong Random number, in Double Submit Cookies method?

I was just going through the OWASP's Cheat Sheet for CSRF Prevention. In the Double Submit Cookies method, I saw this the site should generate a (cryptographically strong) pseudorandom value ...
2
votes
2answers
441 views

Double Submit Cookies vulnerabilities

Is the Double Submit Cookies mechanism vulnerable anything other than XSS and sub-domain attacks? All CSRF protection mechanisms are vulnerable to XSS, so that's nothing new. I'm just wondering if I ...
1
vote
0answers
95 views

CAS protection against CSRF attacks

A website based on Apache Struts uses central authentication service (cas) for login. I'd like to know if additional csrf protection needs to be provided with Struts in case cas doesn't provide that. ...
1
vote
1answer
128 views

CSRF Token Stealing

I came across this link that dicusses how an attacker could exploit access control allow origin to get an anti-CSRF token: ...
14
votes
5answers
2k views

Why does an anti-forgery token need so many bits?

In https://developers.google.com/accounts/docs/OAuth2Login#createxsrftoken Google recommends using a 130-bit cryptographically-secure random number as an anti-forgery token. Why do we need so many ...
2
votes
1answer
115 views

Does using token-based auth make CSRF checks on login unnecessary?

Based on my understanding, avoiding the use of cookies as an authentication mechanism prevents CSRF vulnerabilities entirely (namely token based authentication in an SPA), when authenticated. Does ...
2
votes
1answer
227 views

How are Ajax requests vulnerable to CSRF attacks if the Same-origin policy is applied?

What I know about CSRF is that a malicious website tricks a normal user into issuing a request to a trusted website using a form. I understand that is possible because we can post forms to different ...
7
votes
3answers
368 views

What are the risk implications of not verifying referer header on login form?

Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to ...
18
votes
4answers
7k views

Why refresh CSRF token per form request?

In many tutorials and guides I see that an CSRF token should be refreshed per request, my question is why do I have to do this? Isn't a single CSRF token per session much easier than regenerating one ...
9
votes
2answers
4k views

OAuth2 Cross Site Request Forgery, and state parameter

http://tools.ietf.org/html/draft-ietf-oauth-v2-30#section-10.12 says: The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the redirection URI ...
7
votes
2answers
286 views

Are my session settings secure enough?

I'm developing a file hosting and sharing web application. Are the following PHP session settings secure enough? ini_set('session.cookie_httponly', 1); ini_set('session.cookie_lifetime', 0); ...
3
votes
2answers
197 views

Retrieving CSRF token cross-domain using JSONP, risky?

Looking at this previous question, the answer suggests that using a GET request to retrieve a CSRF token in order to make a POST is a legitimate method of preventing CSRF attacks. I have two ...
1
vote
1answer
133 views

Prevent CSRF using ViewState?

According to OWASP you can prevent CSRF in a ASP.NET application if you include the SessionID in the ViewState. From the article: Viewstate can be used as a CSRF defense, as it is difficult for ...
1
vote
2answers
314 views

Using the Synchronizer Token pattern, should you ensure the CSRF token is only communicated via HTTPS?

Put simply, CSRF tokens can be sniffed out of responses from the server unless the request/response are transmitted using encryption. Is this enough of a concern to worry about, or is it reasonable ...
-4
votes
1answer
116 views

Using same CSRF Token for Multiple account creation [closed]

While Pentesting through some sites i found that an Multiple account's can be created using same CSRF token which should not allowed.I want to place two scenario's to describe my question. Scenario ...