a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

learn more… | top users | synonyms

1
vote
1answer
87 views

Preventing CSRF attacks against websocket communications

I have read the thread about CSRF attacks in websockets (Do websocket-powered web apps (e.g. "comet" apps) have to worry about CSRF?) and also some more material regarding websocket ...
-6
votes
0answers
28 views

Stealing secret details from response [closed]

Is it possible to steal secret details like csrf token when csrf token is being reflected in response of GET request? If yes, could you help me to write script for it? I mean stealing csrf toke of ...
0
votes
1answer
110 views

CSRF Guard: Injects token in POST Request?

I have implemented CSRF Guard into my web application. It's working fine for GET requests (with AJAX and without AJAX) however for POST request token is not getting injected into the request that's ...
2
votes
2answers
149 views

Why does this CSRF vulnerability work?

Recently Laravel 4 was updated to address a security concern: there was a CSRF vulnerability in their code. Here's the old code: if (Session::token() != Input::get('_token')) { throw new ...
0
votes
2answers
67 views

Are CSRF tokens useful outside of web APIs?

I'm trying to understand CSRF tokens and one thing isn't making sense to me. For a web API, you can provide a CSRF token just once, on authentication, and expect the client to remember that token ...
0
votes
1answer
37 views

OAuth + Confused Deputy + access token verification + state parameter

Google's "Using OAuth 2.0 for Client-side Application" article at https://developers.google.com/accounts/docs/OAuth2UserAgent states that the client MUST validate all access tokens to verify that it ...
1
vote
3answers
3k views

How to share CSRF token to client application?

I have two different web application. Services web app has REST Services defined. Client web app has JSP pages which makes call to REST services using Ajax to get the data and display in the UI. I ...
1
vote
2answers
94 views

Should CSRF token without session cookie work?

Let's say that website example.com has CSRF protection. They send CSRF token in custom header and in hidden input fields. For example to add new folder, your http request need to contain CSRF token. ...
1
vote
2answers
45 views

CSRF Implementation

I am working on website,where I want include csrf checks by using referrer checks,will this be sufficient way to protect the form from csrf attack? if not what an attacker can do to bypass it?
3
votes
1answer
159 views

What constitutes an exploit? I was able to compromise my common household router

Was setting up Wifi at home today (just using the default router Time Warner Cable provides) and was appalled at the minimal security that the web server provides. Default user name/password is ...
2
votes
1answer
60 views

CSRF-protection using authentication token in HTTP header

I'm working on a web application which stores an authentication token in a cookie. The only CSRF-protection is referrer checking. I am considering improving this by moving the authentication token ...
1
vote
0answers
19 views

Send CSRF token to javascript [migrated]

Suppose I maintain a anti CSRF token at server side in a session How am I supposed to pass the token to client side application if my form generation is going to be dynamic(i.e. form will be created ...
2
votes
1answer
39 views

why application/json content type have csrf token?

If Json Applications are properly verifying the content type and have well configured crossdomain.xml, then why they still used csrf token? Could anybody tell me , why they use csrf token ? AFAIK, ...
0
votes
4answers
47 views

csrf attack when the victim not logged in

If an attacker sends a malicious code for state changing event to a victim and the victim opens that malicious link and clicks on the submit button, can the attack take place when the user is not ...
1
vote
1answer
43 views

Other than synchronizer token, is there any way of protection against CSRF using http headers?

Recently I came across some websites using HTTP Header namely X-XSRF-Token and a cookie with similar name. Is it a better mitigation than using random token based security for CSRF?
2
votes
1answer
46 views

Is there a strong protection against CSRF executed from the sames server via stored XSS?

If we have a domain with stored-XSS vulnerability. I know it's already critical!.. But, I'm talking about limiting the damage. The hacker can't get the session cookie of the admin, because it's ...
20
votes
5answers
12k views

What is the correct way to implement anti-CSRF form tokens?

I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet. I've created tokens as a md5 of username, form info and a salt and stored it ...
3
votes
2answers
415 views

Do websocket-powered web apps (e.g. “comet” apps) have to worry about CSRF?

The standard advice for HTTP applications wanting to prevent Cross Site Request Forgery is to include a random token on each state-changing request (usually POST) which is verified by the server ...
1
vote
3answers
127 views

Would this generated CSRF token be considered cryptographically strong?

I am working on enhancing the security of an existing web application which currently has not implemented the use of anti-CSRF tokens, so it is up to me to generate one, add the hidden fields and ...
0
votes
1answer
216 views

is HttpOnly and Secure cookie enough to prevent CSRF in rest api?

I created one RESTful API using spring. I am transmitting a secret key as HttpOnly & Secure cookie with login response. After login every rest request will check with that cookie and update it ...
0
votes
1answer
39 views

Modern Browsers, Safe to Ignore CSRF?

For users using modern browsers, is it safe to assume they won't be able to be hijacked via CSRF and the likes? If not, how likely is it that an attack can take place?
0
votes
1answer
61 views

CSRF Guard - Can it protect service call also?

I'm implementing CSRF guard in my web application. I have done all the required configuration and I can see token getting generated/injected into the request header. Let me tell you application's ...
6
votes
1answer
56 views

When generating CSRF token

I'm building a CSRF prevention method in our application framework. I use, inter alia, the OWASP site. We have chosen for the "Double Submit Cookies" prevention meassure, described at the OWASP CSRF ...
8
votes
1answer
79 views

CSRF in ASP.NET

There's this "change password" ASP.NET form that has both event validation and viewstate enabled. There are no specific anti-csrf tokens. From I understanding, in order to execute a successful CSRF ...
3
votes
3answers
177 views

Why doesn't XSS vulnerability from the site launching the CSRF attack make the Synchronizer Token Pattern insecure?

I was reading this question about using Synchronizer Token Pattern to protect against CSRF and the comments of the answer intrigued me. Of course, as the last comment says, if your site has an XSS ...
6
votes
2answers
2k views

CSRF prevention in PHP

Two questions. Where does one download the PHP version of OWASP's CSRF Guard? The following URL says to check Git: https://www.owasp.org/index.php/PHP_CSRF_Guard All I see on Git however is ...
4
votes
1answer
447 views

Why are CSRF tokens used so often?

CSRF tokens are used a lot. The server sets a token in cookie for that domain that either (1) include in the HTML form or (2) Javascript can read and include in the request. The server verifies the ...
2
votes
2answers
146 views

Should every post request include csrf token?

What is the vulnerability level if the anti-csrf token is not sent with every post request? (If the vulnerability levels were high, medium and low). I understand for critical functions like login etc ...
1
vote
2answers
81 views

Is it considered a CSRF if it requires a unique identifier which is not a CSRF token - not tied to the user session?

Consider an end point such as below. Let's imagine that this endpoint updates an address of the signed in user, changing the zip code. The address to update is identified by the address ID ...
0
votes
1answer
64 views

The Spring Security framework recommends against using double-submit cookies to prevent CSRF. Is their concern legitimate?

I was about the Spring Security framework's CSRF protection to see how it works. Spring doesn't use the double-submit pattern, but instead associates the CSRF token with the user's session. The ...
3
votes
2answers
213 views

_ _ VIEWSTATE to Protect Against CSRF

I am not a .NET developer and I am trying to understand how exactly does __ViewState protect against CSRF/XSRF attacks. I came across the following : security Stack exchange discussion on similar ...
3
votes
3answers
275 views

How is the same origin policy causing my PoC to fail when I don't need to read return data?

I'm performing an authorized vulnerability analysis on a custom web service and have discovered a CSRF vulnerability. Due to there not being form tokens coupled with the service not checking for the ...
0
votes
1answer
196 views

extracting JSESSIONID from document.cookie

I was trying cookie stealing on a java and spring based web application. Normally, a cookie can be obtained through <script>alert(document.cookie)</script>, but in the above code, cookie ...
5
votes
1answer
1k views

CSRF prevention for RESTful services

Am I right If I claim on that there doesn't exist any reliable protection against CSRF for a stateles environment today? I have a RESTful service (build with RESTEasy) that needs to be secured against ...
1
vote
3answers
130 views

Will checking the CSRF token on the header and the form's hidden be enough?

From what I read here, CSRF tokens from the cookie header cannot be read because of the same-origin policy. Is comparing the CSRF token on the cookie header with the form's hidden element be ...
8
votes
4answers
1k views

Can anti-CSRF token prevent bruteforce attack?

I am not much experienced with brute force attacks but I was wondering Suppose, you have a website www.example.com and you want to do brute force attack on that login form but that login form is ...
1
vote
0answers
95 views

Secure Single Page Application (SPA) served from a CDN

Is it possible to secure a Single Page Application (SPA) served from a CDN that communicates with a REST API, assuming the following: The front end communicates with a backend REST API using a token ...
1
vote
1answer
686 views

how can we find the CSRF vulnerability in a website?

I heard that there are no specific tools available to test and find out the CSRF vulnerability of a website. So from a security testers point of view, how to test for the CSRF vulnerability?
0
votes
1answer
222 views

jquery $.post CSRF protection

How can I protect the following code from CSRF? $.post("lib/newEmployee.php",{employee_id: employee_id, employee_name: employee_name}, function (output){ //code }); ...
2
votes
2answers
825 views

Are HTTPOnly Cookies submitted via XmlHTTPRequest with withCredentials=True?

I have a two part question here. I have a javascript webapp accessing privileged REST endpoints. I would like to protect against CSRF. Currently, I have a login system built which returns a login ...
0
votes
1answer
44 views

May I write the CSRF token to a script

The django docs tell us that our AJAX scripts should acquire the token from the designated cookie as in get_cookie('_csrf_token'). Can I rather print it to the HTML source, so that it's available to ...
0
votes
3answers
59 views

should I give the csrf token a descriptive name?

Personally I want to call the element _DO_NOT_give_this_security_thingy_to_anybody_ever. An example scenario is some clever social engineers want the user to run a malicious "add a friend" and find ...
0
votes
1answer
34 views

recreating CSRF Token after usage [duplicate]

Is it a good practice to recreate the CSRF Token once its been used (basically create a new taken after a post request is sent)? Or it an unnecessary measure to take? My current system is recreating ...
7
votes
2answers
806 views

Does CSRF prevention also prevent reflected XSS attack?

What I understand about reflected XSS is ... When a web application is vulnerable to this type of attack, it will pass unvalidated input sent through requests back to the client... [1] ...
0
votes
1answer
123 views

CSRF vulnerability in CGI/shell script web interface of hardware

I have a web interface to a hardware that is primarily used to reboot the hardware. Reboot can be done only by authenticated user.The web interface is written in CGI/shellscript. It does not use any ...
1
vote
1answer
54 views

Acronym CSRF refer to token or the attack itself?

I am really confused of what CSRF is. I know it stands for Cross-site request forgery. http://en.wikipedia.org/wiki/Csrf When you read it here it talks about cross site request forgery attack. But ...
0
votes
0answers
15 views

csrf best practices [duplicate]

I store the csrf token in a form and compare it against what I have in cache. Sometimes I store the csrf token in cookie and compare it against what I have in cache. I generate new csrf tokens every ...
0
votes
1answer
344 views

Why can Oauth2 redirect_uri be a non-https URI?

I'm building a small site which I would like to integrate with LinkedIn for authentication. LinkedIn says that redirect_uri's can be either http:// or https:// (not having to pay for a certificate is ...
1
vote
4answers
688 views

Configure Firefox against malicious 302 redirect from a embedded image resource?

Today my friend demonstrated such a attack. I am using RenRen, a social networking website in a way very like Facebook in China. And I saw an article he wrote. Actually there is only an "image" ...
3
votes
2answers
202 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...