a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

learn more… | top users | synonyms

0
votes
1answer
55 views

Does HTTPS protect from session riding?

In a typical session riding scenario, the attacker tricks the victim into sending an HTTP request to a web site they are already logged in to. For example, tricking victim to click on a link to ...
12
votes
4answers
5k views

Must login and logout action have CSRF protection?

I am making a web application in Django which generates and includes CSRF tokens for sessions (a Django session can be anonymous or a registered user). Should I keep CSRF protection to the controllers ...
0
votes
2answers
144 views

Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?

The Python code below should grab a "csrf token" cookie from Instagram.com, but I get an error message when running the program through any sort of https or socks5 proxy, informing me that the "csrf" ...
0
votes
1answer
24 views

Anti CSRF tokens with a black box

Consider an app you develop that uses something like the OWASP CSRFGuard library. What can be done to protect against XSS if the app calls a third party black box app that has no way to store and ...
1
vote
1answer
32 views

CSRF on anonymous forms

We have a site which has a form on it asking for a piece of information (a state, selected from a dropdown - which changes the screens returned). Anonymous users interact with this form. When we scan ...
0
votes
1answer
37 views

CSRF token generation and validation

I am trying to implement XSS best practices on a site I’m making. I am currently generating a secure token on my server and sending it back to the user as a form hidden field, then validating that ...
0
votes
2answers
93 views

Need help understanding OWASP Vulnerabilities [closed]

I am doing a whitepaper on simplifying OWASP 10 vulnerabilities based on an article our teachers suggested. Can you guys help or provide more resources here? What are your views? Will like to ...
3
votes
2answers
1k views

_ _ VIEWSTATE to Protect Against CSRF

I am not a .NET developer and I am trying to understand how exactly does __ViewState protect against CSRF/XSRF attacks. I came across the following : security Stack exchange discussion on similar ...
3
votes
1answer
40 views

Access control allow origin browser protection efficiency

I was building a website as an experiment, and tried using few ajax requests to different sites. On some sites I will get an error: XMLHttpRequest cannot load http://example.com/path No 'Access-...
1
vote
1answer
142 views

CSRF tokens in Single Page Applications (JavaScript/Angular)

I have an AngularJS SPA served by Apache on a cheap web host. All communication to the backend is via Ajax REST calls to an expensive cloud server running Tomcat. How can the REST calls be protected ...
34
votes
2answers
61k views

Why is the Access-Control-Allow-Origin header necessary?

I understand the purpose of the Access-Control-Allow-Credentials header, but can't see what problem the Access-Control-Allow-Origin header solves. More precisely, it's easy to see how, if cross-...
4
votes
4answers
573 views

Is CORS helping in anyway against Cross-Site Forgery?

I've been reading in the last couple of days about CORS and in a lot of places it's mentioned as it is a "Security" feature to help the world from cross domain forgery. I still don't see the benefit ...
5
votes
1answer
1k views

Does returning Access-Control-Allow-Origin: * weaken the security of JSON GET responses?

The W3C CORS recommendation states: Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins. ... 3. A GET ...
8
votes
3answers
2k views

If I never want cross origin requests to be accepted, can I just ignore CORS?

The CORS spec states that if a request method and headers are not simple then a preflight HTTP OPTIONS request is sent to see if the request is allowed by the server. My server does not respond with ...
-1
votes
1answer
39 views

Hosting CSRF Token at URL

When implementing CSRF protection, one generally uses a CSRF cookie that must be included in the body of the request. This prevents CSRF attacks because the malicious website cannot read the other ...
1
vote
1answer
42 views

How is CSRF token verified?

I would like to know how the CSRF tokens are verified on form submit? Please tell me whether the following is correct: Server issues a random string which is set as the session cookie, and a value ...
4
votes
2answers
76 views

Is there any effective server-side prevention technique against PHP-aided CSRF?

I'm gonna start by saying it: I'm merely a cybersecurity enthusiast, not an expert. Thus, I'm gonna state what I think I know so far, please feel free to correct me at any time. Through my readings, ...
0
votes
0answers
47 views

How do anti cross-site request forgery tokens work?

Can anyone explain how CSRF tokens work in simple terms? Why should the CSRF-token be stored in a session cookie as well as in a hidden form field?
6
votes
3answers
170 views

Does CSRF work when the target site is not open on a tab?

This is an example attack scenario of OWASP for CSRF The application allows a user to submit a state changing request that does not include anything secret. For example: http://example.com/...
10
votes
3answers
8k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
12
votes
2answers
12k views

Does ASP.NET Viewstate implicitly prevent CSRF attacks? What does this mean for MVC?

If an encrypted ASP.NET Viewstate is submitted with every form, and control POST, does that mean that ASP.NET is less vulnerable to CSRF than other solutions with this? What is the extent and ...
1
vote
1answer
71 views

How does XSRF-token per request work? (Angular solution)

I want to protect my application against XSRF. Although I couldn't really understand what the problem is and how my solution works, after some research I came up with a solution, which Angular uses. ...
1
vote
2answers
98 views

Is it possible to make the back button work if we use one CSRF-token per request?

Do we need to compromise on back button navigation if we use one CSRF-token per request instead of one token per session? (I was successful in using one token per session without any navigation ...
1
vote
1answer
254 views

OAuth + Confused Deputy + access token verification + state parameter

Google's "Using OAuth 2.0 for Client-side Application" article at https://developers.google.com/accounts/docs/OAuth2UserAgent states that the client MUST validate all access tokens to verify that it ...
-6
votes
1answer
67 views

Where is the CSRF vulnerability in this Python CGI application? [closed]

I have the following Python code, and I am wondering which line is most likely to expose a CSRF vulnerability. import cgi import Cookie c = Cookie.SimpleCookie() form = cgi.FieldStorage() email = ...
0
votes
2answers
155 views

exploiting CSRF in ajax request via XSS flaw

In an application i am testing, there is a stored XSS flaw. Now, I was testing for CSRF and I constructed an HTML page with a javascript that sends the ajax request (XHR). It caused a pre-flight ...
0
votes
2answers
76 views

Send a CSRF attack with a specific header referrer?

There's any way to bypass a referrer CSRF protection and force www.attacker.com to send a POST request to www.victim.com with the header showing as "referer: https://www.victim.com/"? For example the ...
3
votes
2answers
120 views

Is it possible to trick a person into going to a website, and running JavaScript, without them knowing? (no iframes)

My website is W. If you make a GET request to my website, it gives you JavaScript, and if you execute the JS, then you do some action (if you are logged in and have a session cookie). Can someone ...
0
votes
2answers
62 views

How is JSESSIONID determined in this CSRF test?

I'm working on testing CSRF protection for one of our webapps. We have a test case like the following: <!DOCTYPE html> <html> <head> </head> <body> &...
2
votes
2answers
904 views

CSRF Login: can Attacker Login using valid credentials?

Consider the picture below (taken from page 21 here). Is this possible? If so, how can I prevent it?
4
votes
3answers
2k views

GET and POST request vulnerable to CSRF attack?

Are both GET and POST request vulnerable to CSRF? Should we use PUT instead?
2
votes
2answers
367 views

CSRF protection for unauthenticated requests, actions, searches or comments?

I have gone through the example of CSRF funds transfer from a bank where the user is logged in. Similarly I have looked at CSRF in case of email updating. I think I understood it but I am not quite ...
1
vote
3answers
383 views

Need help understanding Windows Authentication mechanism

Even if I enforce HTTPS and use anti-forgery tokens, it seems like Windows Authentication could be inherently insecure because it does not require that the user explicitly passes credentials from the ...
5
votes
5answers
207 views

Should I use CSRF protection for GET requests?

I've seen several blanket statements on the web to the effect that you don't need CSRF protection for GET requests. But many web applications have GET requests that return sensitive data, right? Then ...
6
votes
1answer
290 views

PHP bin2hex vulnerable to timing attack?

I've read in a few places[1][2][3] of the desire to make PHP's bin2hex constant time. In what scenarios would bin2hex be vulnerable to a timing attack? Is this below code for handling a CSRF token ...
2
votes
2answers
531 views

Is a JWT usable as a CSRF token?

I'm in need of a CSRF token, for a certain application that submits a form with POST. Ideally, I'd like to not make a DB call for each submission, to avoid storage and DB traffic & latency. To ...
1
vote
2answers
170 views

Should I use one CSRF token per page or per form?

Is it safe to use one CSRF token per form on my page, ex: <form> <input type="hidden" name="token" vale="<?=$data['login_token'];?>" />" </form> <form> <input ...
5
votes
1answer
910 views

Why CSRF's JS can't read token by GETting html

1) User is logged in bank.com in one tab, where everything is secured by CSRF tokens. Then he opens evil.com in another tab. 2) Javascript in evil.com might try to make a POST request to bank.com/...
3
votes
1answer
202 views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
0
votes
0answers
45 views

Security issue with CSRF token

My website has CSRF vulnerabilities. I have tried to mitigate the risk. Whenever users try to perform CSRF attack, they will be redirected to login page for re-authentication. On top of that, I ...
3
votes
2answers
69 views

Signing Double Submit Cookies, where the value is a pseudo random string and a signature of it. Is this more secure?

I'm not sure if I am describing something that has already been proposed. If not, I would like to coin this "Signed Double Submit Cookies" as a method to improve the Double Submit Cookies technique ...
1
vote
1answer
88 views

Security concerns of HTML echo endpoint

Consider a website with an endpoint that, when a payload of an HTML string (full document or partial segment) is POST to it, the server will transform the payload (and sometimes no transform is ...
2
votes
3answers
3k views

CORS & CSRF Prevention for an REST based API

I'm currently trying to wrap my head around how to prevent CSRF. My first solution was to use a token which is suggested everywhere. That would of course fix this problem: <img src="http://api....
2
votes
2answers
64 views

What can a user do in order to protect against CSRF attacks?

If I'm browsing while I'm logged in into my hosting panel or router or any other application, there is a chance of being hacked by a CSRF exploit. So, the question here is about user or client-side ...
5
votes
2answers
134 views

What to use as 'state' in OAuth2 Authorization Code Grant workflow

I'm using csrf protection in my web app. Now I'm planning to trigger a OAuth2 Authorization Code Grant workflow, starting with a static template opened in a new browser window using window.open(...
1
vote
0answers
50 views

Are Web Services vulnerable to CSRF?

I'm testing an android application, it uses web services for every action, so I saw the requests don't have tokens or another anti-automation mechanism, they just need to validate a token to identify ...
4
votes
2answers
90 views

Why would a modern browser allow internal resources to be loaded from an external page

Recently someone announced that several Arris surfboard models lacked any form of authentication to perform functions such as reboot and factory reset a modem with a single http call. Read more on ...
3
votes
2answers
143 views

Can CSRF protection work even if an XSS vulnerability exists?

Need for CSRF protection that withstands an XSS attack One of the big dangers of XSS is that it can often bypass CSRF protection and thus perform any action the victim can perform. If it would be ...
1
vote
1answer
181 views

Is JWT in cookies with any CSRF solution just as vulnerable to XSS as JWT in localStorage?

I've read that JWT tokens shouldn't be stored in localStroage because XSS attacks can read them. The proposed solution is to store JWT tokens in HTTPOnly cookies and use anti-CSRF w/ double-submit ...
3
votes
1answer
63 views

How does the same-origin-policy protect against PUT/DELETE CSRF?

I've read the OWASP guide for cross-site request forgery and it states that "other HTTP methods", such as PUT and DELETE could be theoretically used for CSRF. However with the same-origin-policy ...