a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

learn more… | top users | synonyms

1
vote
0answers
22 views

Is it okay to add CSRF synchronized token by modifying HTML from a valve/filter?

Is it okay to modify the html and add a hidden field containing the CSRF token to all the forms inside a page using a valve or a filter before going to the browser? I'm thinking on this line since I ...
6
votes
2answers
2k views

Must login and logout action have CSRF protection?

I am making a web application in Django which generates and includes CSRF tokens for sessions (a Django session can be anonymous or a registered user). Should I keep CSRF protection to the controllers ...
1
vote
1answer
31 views

Handling CSRF tokens on pages longer than the PHP session limit

I have a page that is open (i.e. requires no login) and allows users to give quick feedback. This page is available on a single shared PC or tablet. The form itself has a CSRF token on it. Problem is ...
4
votes
2answers
35 views

CSRF expiring before form submitted

I have a very long web form that could take hours for people to complete. The problem with this is when people take too long the CSRF token expires before they're done and when they hit submit they ...
1
vote
0answers
29 views

Is it necessary to add CSRF tokens for REST API? [duplicate]

I have a few REST APIs for an iPhone app. It has a login and session management functionality. Currently the session has been tracked by a token set during login. Are REST services affected by CSRF ...
2
votes
0answers
22 views

Is it safe to store bearer tokens in an iframe and/or pass them back to the parent window

I am not a security expert, so I am hoping that a few of you might be able to tell me if there are any gaping flaws in the security design for my web app. Hopefully I'll be able to explain this ...
5
votes
1answer
151 views

PHP bin2hex vulnerable to timing attack?

I've read in a few places[1][2][3] of the desire to make PHP's bin2hex constant time. In what scenarios would bin2hex be vulnerable to a timing attack? Is this below code for handling a CSRF token ...
0
votes
1answer
29 views

how to test for csrf if the web application is not using tokens and there are no users defined for that application?

I am testing an application that doesn't use anti-csrf tokens for its requests. There are no users defined for this application as well. Well, in that case, how to carry out testing for csrf in this ...
13
votes
4answers
3k views

How to protect against login CSRF?

http://seclab.stanford.edu/websec/csrf/csrf.pdf points out that most CSRF protection mechanisms fail to protect login forms. As http://stackoverflow.com/a/15350123/14731 explains: The ...
3
votes
2answers
85 views

Are phone apps vulnerable to XSS or CSRF? (Webview, Phonegap, chrometab)

I need to provide evidence that CSRF or XSS is possible on a phone... using PhoneGap, a Webview, or specifically a "Chrome Tab" or iOS equivalent. I believe in theory this is possible, and mitigation ...
5
votes
3answers
576 views

Is it secure not to have csrf protection in login forms?

I have noticed that WordPress doesn't have csrf protection for their admin panel login /wp-admin/. Does it actually posses any potential risk? Is there any possible ways there an attacker could ...
0
votes
1answer
44 views

How to check the origin header server-wide in IIS to prevent CSRF

Whereas I'm aware that the synchronizer pattern is the recommended approach to prevent CSRF attacks, I am in a situation where it would be a lot faster to implement the origin header check. I was ...
2
votes
3answers
89 views

Why is the synchronizer token pattern preferred over the origin header check to prevent CSRF

I am well aware of the concept of CSRF, and I think I am also aware of the possible protection possibilities, as described by OWASP. However, I'm not sure why the synchronizer pattern seems to be ...
2
votes
1answer
290 views

Preventing CSRF attacks against WebSocket communications

I have read the thread about CSRF attacks in websockets (Do websocket-powered web apps (e.g. "comet" apps) have to worry about CSRF?) and also some more material regarding websocket ...
0
votes
1answer
87 views

CORS & CSRF Prevention for an REST based API

I'm currently trying to wrap my head around how to prevent CSRF. My first solution was to use a token which is suggested everywhere. That would of course fix this problem: <img ...
-1
votes
4answers
66 views

Custom CSRF protection mechanism without persisting tokens

I have had this functionality (csrf protection) for quite some time now. The thing I never liked about it is that it saved csrf tokens in the session file. While it may not be a real problem I see it ...
2
votes
3answers
289 views

GET and POST request vulnerable to CSRF attack?

Are both GET and POST request vulnerable to CSRF? Should we use PUT instead?
0
votes
1answer
68 views

What factors make Android app code vulnerable to Cross-Site Request Forgery attacks?

According to techtarget.com Cross-Site Request Forgery is: a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. An XSRF attack can be used to ...
0
votes
1answer
420 views

CSRF Guard: Injects token in POST Request?

I have implemented CSRF Guard into my web application. It's working fine for GET requests (with AJAX and without AJAX) however for POST request token is not getting injected into the request that's ...
0
votes
2answers
54 views

Is injecting a second Authenticity_Token on a login request considered a security threat?

I'm running a security test on a website. The login request looks like this: POST /sessions HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) ...
1
vote
1answer
55 views

How to test for CSRF if there are many hidden fields with different values?

Wanted to test specific hidden fields with different values for each with test case of cross site request forgery. How would one do so? Both manual and an automated approach would do. Exclusion ...
2
votes
2answers
138 views

Usability and CSRF tokens

In a lot of different products the CSRF token is stored in a session. Which means that if the session has expired then the next form submit will fail. Example scenario: you open a login form, the ...
28
votes
5answers
12k views

Why refresh CSRF token per form request?

In many tutorials and guides I see that an CSRF token should be refreshed per request, my question is why do I have to do this? Isn't a single CSRF token per session much easier than regenerating one ...
2
votes
3answers
5k views

How to share CSRF token to client application?

I have two different web application. Services web app has REST Services defined. Client web app has JSP pages which makes call to REST services using Ajax to get the data and display in the UI. I ...
1
vote
1answer
148 views

CSRF protection for unauthenticated requests, actions, searches or comments?

I have gone through the example of CSRF funds transfer from a bank where the user is logged in. Similarly I have looked at CSRF in case of email updating. I think I understood it but I am not quite ...
3
votes
2answers
73 views

Can postMessage be used to forward data to hacker's iframe in CSRF attack?

Consider a user that has an open session to a legitimate site with a password on it. This page has no anti-CSRF token. A hacker creates a webpage with 2 hidden iframes. One iframe does a GET on the ...
2
votes
2answers
169 views

CSRF Encrypted-Token pattern protection implementation

I'm implementing CSRF protection using the Encrypted Token Pattern (as per https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet#Encrypted_Token_Pattern). I ...
1
vote
0answers
34 views

Oauth authentication without state parameter

I have some security concerns about the first step of account authentication in my application. The authentication goes through an OpenID provider. If the response of such provider shows that the ...
3
votes
2answers
513 views

Do WebSocket-powered web apps (e.g. “comet” apps) have to worry about CSRF?

The standard advice for HTTP applications wanting to prevent Cross Site Request Forgery is to include a random token on each state-changing request (usually POST) which is verified by the server ...
1
vote
0answers
61 views

Is there a security vulnerability to permit all CORS origins if the request origin matches a pattern?

Originally asked at: http://stackoverflow.com/questions/29526990/is-there-a-security-vulnerability-to-permit-all-cors-origins-if-the-request-orig We had a requirement to permit cross-origin requests ...
0
votes
1answer
257 views

How to bypass XMLHttpRequest header protection for a CSRF attack

A client is only submitting forms using XMLHttpRequest with the use of a header (X-Header: [any value would be correct]) to protect against Cross Site Request Forgery attacks. I know this is not the ...
1
vote
1answer
99 views

Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?

Here is a test case from a recent application security asessment which I have had experienced: cookie = new Cookie(strKey1, EncryptDecrypt.encrypt(strValue)); cookie.setMaxAge(-1); ...
3
votes
1answer
203 views

How to fix open redirect vulnerability?

In redir.php: header("Location: {$_GET['addr']}"); For fixing open redirect vulnerability i can think of several ways: 1- (Side effect of) Using a security token (anti-csrf token): ...
0
votes
1answer
116 views

CSRF on GWT apps : bypassing the Same-Origin policy

At work we suspect a GWT app (that is not in production yet) we own to be vulnerable to CSRF. We have to look at it from a black-box point of view before a third-party security audit will be ...
11
votes
2answers
6k views

OAuth2 Cross Site Request Forgery, and state parameter

http://tools.ietf.org/html/draft-ietf-oauth-v2-30#section-10.12 says: The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the redirection URI ...
1
vote
4answers
792 views

Configure Firefox against malicious 302 redirect from a embedded image resource?

Today my friend demonstrated such a attack. I am using RenRen, a social networking website in a way very like Facebook in China. And I saw an article he wrote. Actually there is only an "image" ...
2
votes
1answer
89 views

Can you steal session cookie with BREACH attack?

Most of the discussions about the BREACH vulnerability are around stealing session-based CSRF tokens. But if you can steal a session-based token, could you also steal the session token itself? ...
2
votes
2answers
259 views

Why does this CSRF vulnerability work?

Recently Laravel 4 was updated to address a security concern: there was a CSRF vulnerability in their code. Here's the old code: if (Session::token() != Input::get('_token')) { throw new ...
0
votes
2answers
148 views

Are CSRF tokens useful outside of web APIs?

I'm trying to understand CSRF tokens and one thing isn't making sense to me. For a web API, you can provide a CSRF token just once, on authentication, and expect the client to remember that token ...
0
votes
1answer
84 views

OAuth + Confused Deputy + access token verification + state parameter

Google's "Using OAuth 2.0 for Client-side Application" article at https://developers.google.com/accounts/docs/OAuth2UserAgent states that the client MUST validate all access tokens to verify that it ...
1
vote
2answers
424 views

Should CSRF token without session cookie work?

Let's say that website example.com has CSRF protection. They send CSRF token in custom header and in hidden input fields. For example to add new folder, your http request need to contain CSRF token. ...
1
vote
2answers
67 views

CSRF Implementation

I am working on website,where I want include csrf checks by using referrer checks,will this be sufficient way to protect the form from csrf attack? if not what an attacker can do to bypass it?
3
votes
1answer
202 views

What constitutes an exploit? I was able to compromise my common household router

Was setting up Wifi at home today (just using the default router Time Warner Cable provides) and was appalled at the minimal security that the web server provides. Default user name/password is ...
2
votes
1answer
162 views

CSRF-protection using authentication token in HTTP header

I'm working on a web application which stores an authentication token in a cookie. The only CSRF-protection is referrer checking. I am considering improving this by moving the authentication token ...
2
votes
1answer
106 views

why application/json content type have csrf token?

If Json Applications are properly verifying the content type and have well configured crossdomain.xml, then why they still used csrf token? Could anybody tell me , why they use csrf token ? AFAIK, ...
0
votes
4answers
66 views

csrf attack when the victim not logged in

If an attacker sends a malicious code for state changing event to a victim and the victim opens that malicious link and clicks on the submit button, can the attack take place when the user is not ...
1
vote
1answer
61 views

Other than synchronizer token, is there any way of protection against CSRF using http headers?

Recently I came across some websites using HTTP Header namely X-XSRF-Token and a cookie with similar name. Is it a better mitigation than using random token based security for CSRF?
2
votes
1answer
61 views

Is there a strong protection against CSRF executed from the sames server via stored XSS?

If we have a domain with stored-XSS vulnerability. I know it's already critical!.. But, I'm talking about limiting the damage. The hacker can't get the session cookie of the admin, because it's ...
21
votes
5answers
15k views

What is the correct way to implement anti-CSRF form tokens?

I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet. I've created tokens as a md5 of username, form info and a salt and stored it ...
1
vote
3answers
176 views

Would this generated CSRF token be considered cryptographically strong?

I am working on enhancing the security of an existing web application which currently has not implemented the use of anti-CSRF tokens, so it is up to me to generate one, add the hidden fields and ...