a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

learn more… | top users | synonyms

1
vote
2answers
15 views

Using the Synchronizer Token pattern, should you ensure the CSRF token is only communicated via HTTPS?

Put simply, CSRF tokens can be sniffed out of responses from the server unless the request/response are transmitted using encryption. Is this enough of a concern to worry about, or is it reasonable ...
-4
votes
1answer
46 views

Using same CSRF Token for Multiple account creation [closed]

While Pentesting through some sites i found that an Multiple account's can be created using same CSRF token which should not allowed.I want to place two scenario's to describe my question. Scenario ...
4
votes
2answers
262 views

Can anybody recommend any gems for checking security vulnerabilities?

I want to check one of my RoR projects for security vulnerabilities. So can anybody recommend any gems for my needs?
0
votes
2answers
66 views

Is this anti-forgery scheme secure?

To prevent cross-site request forgery attacks, I'm considering the following scheme: For each user, store a random key. If the user submits any "dangerous" information, include a security token and a ...
1
vote
0answers
57 views

Are HTTPOnly Cookies submitted via XmlHTTPRequest with withCredentials=True?

I have a two part question here. I have a javascript webapp accessing privileged REST endpoints. I would like to protect against CSRF. Currently, I have a login system built which returns a login ...
0
votes
1answer
80 views

How to use a token to differentiate between a valid logged in user and an attack?

Let us take the example of my already being logged in to, say, LinkedIn. When I access LinkedIn on a new tab, it automatically logs me in (using cookie info). Now, suppose I visit a forum and through ...
12
votes
3answers
3k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
2
votes
1answer
61 views

.NET provides 8+ ways to encode data to prevent XSS attacks. Which one should I use when? [closed]

I'm looking at ways to use .NET to prevent XSS attacks and have come across the following methods to encode data: string asdf = WebUtility.UrlEncode(code); string asdf1 = ...
1
vote
2answers
85 views

CSRF: Random value or HMAC

I've seen several implentations of CSRF tokens: The first one uses randomly generated CSRF tokens which uses a cryptographic strong random generator to generate the token. The second implementation ...
0
votes
2answers
85 views

CSRF prevention understanding

I was searching around about CSRF attacks and I am thinking about the "random form token" prevention concept. Let's say every form has a "hidden token" inside and the server checks the token before ...
1
vote
1answer
218 views

Trying to reproduce a file upload compromise on Joomla

After telling my workmates and boss that we had a very critical lack of security controls, finally we got compromised! They had a Joomla 1.5 which was exploited using a file upload vulnerability. WSO ...
5
votes
2answers
697 views

What is the purpose of OAuth 2.0 redirect_uri checking?

The OAuth 2.0 specification's authorization code mechanism includes redirect URI checking from the site you redirect to. See steps D and E in section 4.1 of the spec. Also, section 4.1.3 describes in ...
0
votes
1answer
106 views

Cookie+session based CSRF protection

Consider the following scenario: 1. When user visits a webapp, server:     a) initialize the session;     b) generates CSRF token;     c) ...
2
votes
3answers
155 views

Advantages of multiple valid CSRF tokens

As far as I understand there are two approaches to perform CSRF protection: 1) CSRF token per session - the token is generated once per session. This is the easiest way; 2) CSRF token per request - ...
5
votes
3answers
317 views

Are CSRF Attacks Really Blind

I'm new to CSRF attacks but don't see how they are always blind. Let's say we are dealing with a site where the asset we need to protect is the HTTP response. Something like one's medical history. ...
2
votes
4answers
177 views

Session id on page html source code

I want to know if it's dangerous in any way to store the current logged user session id on the page generated source code. Why I wanted to do that? I'm trying to share the user session between two ...
4
votes
3answers
124 views

Does CSRF work when the target site is not open on a tab?

This is an example attack scenario of OWASP for CSRF The application allows a user to submit a state changing request that does not include anything secret. For example: ...
1
vote
3answers
106 views

Is data exposed in a CSRF attack?

I am wondering wether a CSRF attack, will disclose the information being sent back in a GET request. I need to send a social security number out, to the client a few times, and it is NOT anyone else ...
12
votes
2answers
368 views

Why CSRF Token has to be a Cryptographically Strong Random number, in Double Submit Cookies method?

I was just going through the OWASP's Cheat Sheet for CSRF Prevention. In the Double Submit Cookies method, I saw this the site should generate a (cryptographically strong) pseudorandom value ...
8
votes
2answers
244 views

Is Django's built-in CSRF protection enough?

Django sets a CSRF protection token on the user's machine via a cookie. It then asks for the token on POST requests. If these two don't match, it returns a 403. If I change manually both the cookie ...
1
vote
3answers
761 views

How to share CSRF token to client application?

I have two different web application. Services web app has REST Services defined. Client web app has JSP pages which makes call to REST services using Ajax to get the data and display in the UI. I ...
1
vote
1answer
96 views

handle user-session-cookie and csrf token correctly for javascript app

I have a django web app serving restful api endpoints and a javascript web app communicating with those endpoints through ajax. They are under the same domain but in different ports. server api ...
2
votes
1answer
198 views

What method for CSRF token generation should I use in my scenario?

I'm working on a RESTful API to work with my AngularJS application. Authenticating works by generating an ASP.NET FormsAuthenticationTicket. It is stored in a cookie using ...
7
votes
2answers
3k views

CSRF With JSON POST

I am playing around with a test application which accepts JSON requests and response is also JSON. I am trying to do a CSRF for a transaction which accepts only JSON data with POST method in request. ...
0
votes
1answer
136 views

Does a malicious android WebView break the DoubleSubmittCookie countermeasure against CSRF?

Initial situation: A RESTful webservice defends against CSRF attacks by using the double submit cookie approach. This means that the authentication token gets submitted twice and verified at the ...
0
votes
1answer
97 views

File-structure when using token

I'm using a form-token to secure the validation process of my php-file. Basically the structure of the php-file looks like this: if ($_POST) {//form has been submitted? if (validateFormToken) { ...
1
vote
1answer
251 views

Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *) [duplicate]

I am curious of what all the security implications are if I set the following two HTTP response CORS headers; Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false The only ...
2
votes
1answer
116 views

Submit form with token

I have a token that I want to use to prevent direct access of some php-files. Some of these php-files are loaded via AJAX. The token is used with a session to secure form submission AND to prevent ...
12
votes
2answers
19k views

Why is the Access-Control-Allow-Origin header necessary?

I understand the purpose of the Access-Control-Allow-Credentials header, but can't see what problem the Access-Control-Allow-Origin header solves. More precisely, it's easy to see how, if ...
2
votes
1answer
308 views

With BREACH attack, is session-based CSRF token still secure?

This is something I haven't been able wrap my head around, if BREACH allow leaking of information, do we have to mask or generate CSRF token in a time-based or per-request fashion to make it more ...
4
votes
1answer
124 views

Possible to submit multiple POST requests using CSRF?

I am aware that you can execute a POST request using CSRF using the method below: <form name="x" action="http://site/index/dosomething" enctype="text/plain" method="post"> <!-- stuff ...
1
vote
2answers
463 views

What is the need of security token to prevent CSRF attack?

I have a REST API which is running in one domain and I have a client in another domain. To prevent CSRF I have configured REST API to accept request originated from client application only. I have ...
4
votes
1answer
485 views

Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?

The W3C CORS recommendation states: Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins. ... 3. A GET ...
4
votes
1answer
201 views

CSRF and Flash/Flex

Flash and Flex clients can make RPC calls to a server using the NetConnection and AMF protocols. It's not uncommon to have these RPC calls setup to authenticate based on a cookie. I've heard ...
3
votes
2answers
113 views

Why doesn't XSS vulnerability from the site launching the CSRF attack make the Synchronizer Token Pattern insecure?

I was reading this question about using Synchronizer Token Pattern to protect against CSRF and the comments of the answer intrigued me. Of course, as the last comment says, if your site has an XSS ...
3
votes
3answers
856 views

How about preventing CSRF this way?

According to Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet , the recommended solution to protect web site from CSRF attacking is to implement Synchronizer Token Pattern. And This requires ...
5
votes
2answers
481 views

Are RESTful sites safe against CSRF attacks?

I am having a debate with a coworker about whether our site is vulnerable to CSRF attacks. He is saying that since we are using RESTful AJAX requests for everything that CSRF is not possible. Say a ...
4
votes
1answer
401 views

CSRF prevention for RESTful services

Am I right If I claim on that there doesn't exist any reliable protection against CSRF for a stateles environment today? I have a RESTful service (build with RESTEasy) that needs to be secured against ...
1
vote
2answers
195 views

Is there guidance that says all sessions to be logged off when a user changes their password?

Often when an account is hacked, security guidance is to change your password. However I've noticed that changing a password sometimes isn't enough to log out of other sessions that are active. Is ...
0
votes
3answers
251 views

CSRF possible if params are not passed through query string?

I was reading up on OWASP's page on CSRF and in their example they use a request where the sensitive parameters are stored in the query string: ...
1
vote
1answer
412 views

Why is Access-Control-Allow-Origin required for uncredentialed cross-domain requests?

I understand CSRF and why cross-domain AJAX requests with cookies or other credentials can't be permitted without an Access-Control-Allow-Credentials header explicitly permitting them - otherwise I'd ...
-2
votes
2answers
175 views

Parameterization strategy for hazardous character injection [closed]

I have a input text field for accepting Email ID. If Email ID is not entered by User, I have a client side validation using Java Script to display error message which reads like, "Please enter valid ...
1
vote
2answers
430 views

Generating session CSRF token based on SSL session ID

Following situation: Application is only accessible via HTTPS/SPDY nginx is sending the SSL session ID to the upstream server Upon session start I'd like to use the first 128 characters of that ...
1
vote
2answers
282 views

CSRF protection with cookie and AJAX

I would like to note that I've read the other question with an embarrassingly similar title and it does not contain an answer to my question. I have not used CodeIgniter as a programmer, but I have ...
6
votes
3answers
695 views

CSRF Token in GET request

According to the OWASP testing guide a CSRF token should not be contained within a GET request as the token itself might be logged in various places such as logs or because of the risk of shoulder ...
4
votes
2answers
2k views

CSRF protection and Single Page Apps

I am in the process of writing a thick client web app using Angular.js (single page app) and was wondering what are the best practices for securing the app using a CSRF token. Should I send a CSRF ...
2
votes
2answers
132 views

Is it safer to store the XSRF value inside your JavaScript?

To protect yourself against XSRF, you need to have a separate token on a page. See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood As the posting suggests, its best to have those ...
10
votes
5answers
979 views

CSRF protection with Session Id

To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent? The server would then just ...
3
votes
1answer
238 views

Do websocket-powered web apps (e.g. “comet” apps) have to worry about CSRF?

The standard advice for HTTP applications wanting to prevent Cross Site Request Forgery is to include a random token on each state-changing request (usually POST) which is verified by the server ...
10
votes
2answers
4k views

CSRF protection with custom headers (and without validating token)

For a REST-api it seems that it is sufficient to check the presence of a custom header to protect against CSRF attacks, e.g. client sends "X-Requested-By: whatever" and the server checks the ...