a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

learn more… | top users | synonyms

1
vote
1answer
45 views

Handling CSRF tokens on pages longer than the PHP session limit

I have a page that is open (i.e. requires no login) and allows users to give quick feedback. This page is available on a single shared PC or tablet. The form itself has a CSRF token on it. Problem is ...
1
vote
4answers
191 views

about CSRF on form submit [duplicate]

I'm surely missing something in the picture of how CSRF attacks and protections are working. My understanding in a form-submit scenery is the protection rely on a unpredictable token, someway is ...
6
votes
3answers
2k views

Must login and logout action have CSRF protection?

I am making a web application in Django which generates and includes CSRF tokens for sessions (a Django session can be anonymous or a registered user). Should I keep CSRF protection to the controllers ...
5
votes
2answers
626 views

Why are CSRF tokens used so often?

CSRF tokens are used a lot. The server sets a token in cookie for that domain that either (1) include in the HTML form or (2) Javascript can read and include in the request. The server verifies the ...
9
votes
1answer
575 views

Why can't you steal the synchroniser token to do CSRF? [duplicate]

I'm reading up on CSRF and I came across synchroniser tokens. I don't understand why you can't do a CSRF to get the token to do a real CSRF. Example: bank.com has a form like this at ...
31
votes
7answers
13k views

Why refresh CSRF token per form request?

In many tutorials and guides I see that an CSRF token should be refreshed per request, my question is why do I have to do this? Isn't a single CSRF token per session much easier than regenerating one ...
1
vote
1answer
35 views

how to test for csrf if the web application is not using tokens and there are no users defined for that application?

I am testing an application that doesn't use anti-csrf tokens for its requests. There are no users defined for this application as well. Well, in that case, how to carry out testing for csrf in this ...
2
votes
2answers
79 views

Is this an appropriate anti-CSRF method?

I have the following system in place on my web app and I'd like to know if it's secure. Cookie contains CSRF token. Application detects CSRF token in cookie. Application places token in a header. ...
3
votes
1answer
357 views

Preventing CSRF attacks against WebSocket communications

I have read the thread about CSRF attacks in websockets (Do websocket-powered web apps (e.g. "comet" apps) have to worry about CSRF?) and also some more material regarding websocket ...
0
votes
1answer
178 views

CORS & CSRF Prevention for an REST based API

I'm currently trying to wrap my head around how to prevent CSRF. My first solution was to use a token which is suggested everywhere. That would of course fix this problem: <img ...
1
vote
0answers
42 views

Is it okay to add CSRF synchronized token by modifying HTML from a valve/filter?

Is it okay to modify the html and add a hidden field containing the CSRF token to all the forms inside a page using a valve or a filter before going to the browser? I'm thinking on this line since I ...
4
votes
2answers
47 views

CSRF expiring before form submitted

I have a very long web form that could take hours for people to complete. The problem with this is when people take too long the CSRF token expires before they're done and when they hit submit they ...
1
vote
0answers
33 views

Is it necessary to add CSRF tokens for REST API? [duplicate]

I have a few REST APIs for an iPhone app. It has a login and session management functionality. Currently the session has been tracked by a token set during login. Are REST services affected by CSRF ...
2
votes
0answers
36 views

Is it safe to store bearer tokens in an iframe and/or pass them back to the parent window

I am not a security expert, so I am hoping that a few of you might be able to tell me if there are any gaping flaws in the security design for my web app. Hopefully I'll be able to explain this ...
5
votes
1answer
167 views

PHP bin2hex vulnerable to timing attack?

I've read in a few places[1][2][3] of the desire to make PHP's bin2hex constant time. In what scenarios would bin2hex be vulnerable to a timing attack? Is this below code for handling a CSRF token ...
13
votes
4answers
3k views

How to protect against login CSRF?

http://seclab.stanford.edu/websec/csrf/csrf.pdf points out that most CSRF protection mechanisms fail to protect login forms. As http://stackoverflow.com/a/15350123/14731 explains: The ...
3
votes
2answers
132 views

Are phone apps vulnerable to XSS or CSRF? (Webview, Phonegap, chrometab)

I need to provide evidence that CSRF or XSS is possible on a phone... using PhoneGap, a Webview, or specifically a "Chrome Tab" or iOS equivalent. I believe in theory this is possible, and mitigation ...
5
votes
3answers
608 views

Is it secure not to have csrf protection in login forms?

I have noticed that WordPress doesn't have csrf protection for their admin panel login /wp-admin/. Does it actually posses any potential risk? Is there any possible ways there an attacker could ...
0
votes
1answer
66 views

How to check the origin header server-wide in IIS to prevent CSRF

Whereas I'm aware that the synchronizer pattern is the recommended approach to prevent CSRF attacks, I am in a situation where it would be a lot faster to implement the origin header check. I was ...
3
votes
3answers
129 views

Why is the synchronizer token pattern preferred over the origin header check to prevent CSRF

I am well aware of the concept of CSRF, and I think I am also aware of the possible protection possibilities, as described by OWASP. However, I'm not sure why the synchronizer pattern seems to be ...
-1
votes
4answers
83 views

Custom CSRF protection mechanism without persisting tokens

I have had this functionality (csrf protection) for quite some time now. The thing I never liked about it is that it saved csrf tokens in the session file. While it may not be a real problem I see it ...
2
votes
3answers
335 views

GET and POST request vulnerable to CSRF attack?

Are both GET and POST request vulnerable to CSRF? Should we use PUT instead?
0
votes
1answer
88 views

What factors make Android app code vulnerable to Cross-Site Request Forgery attacks?

According to techtarget.com Cross-Site Request Forgery is: a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. An XSRF attack can be used to ...
0
votes
1answer
479 views

CSRF Guard: Injects token in POST Request?

I have implemented CSRF Guard into my web application. It's working fine for GET requests (with AJAX and without AJAX) however for POST request token is not getting injected into the request that's ...
0
votes
2answers
61 views

Is injecting a second Authenticity_Token on a login request considered a security threat?

I'm running a security test on a website. The login request looks like this: POST /sessions HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) ...
1
vote
1answer
63 views

How to test for CSRF if there are many hidden fields with different values?

Wanted to test specific hidden fields with different values for each with test case of cross site request forgery. How would one do so? Both manual and an automated approach would do. Exclusion ...
2
votes
2answers
148 views

Usability and CSRF tokens

In a lot of different products the CSRF token is stored in a session. Which means that if the session has expired then the next form submit will fail. Example scenario: you open a login form, the ...
2
votes
3answers
5k views

How to share CSRF token to client application?

I have two different web application. Services web app has REST Services defined. Client web app has JSP pages which makes call to REST services using Ajax to get the data and display in the UI. I ...
1
vote
1answer
167 views

CSRF protection for unauthenticated requests, actions, searches or comments?

I have gone through the example of CSRF funds transfer from a bank where the user is logged in. Similarly I have looked at CSRF in case of email updating. I think I understood it but I am not quite ...
3
votes
2answers
84 views

Can postMessage be used to forward data to hacker's iframe in CSRF attack?

Consider a user that has an open session to a legitimate site with a password on it. This page has no anti-CSRF token. A hacker creates a webpage with 2 hidden iframes. One iframe does a GET on the ...
2
votes
2answers
215 views

CSRF Encrypted-Token pattern protection implementation

I'm implementing CSRF protection using the Encrypted Token Pattern (as per https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet#Encrypted_Token_Pattern). I ...
1
vote
0answers
45 views

Oauth authentication without state parameter

I have some security concerns about the first step of account authentication in my application. The authentication goes through an OpenID provider. If the response of such provider shows that the ...
3
votes
2answers
540 views

Do WebSocket-powered web apps (e.g. “comet” apps) have to worry about CSRF?

The standard advice for HTTP applications wanting to prevent Cross Site Request Forgery is to include a random token on each state-changing request (usually POST) which is verified by the server ...
1
vote
0answers
83 views

Is there a security vulnerability to permit all CORS origins if the request origin matches a pattern?

Originally asked at: http://stackoverflow.com/questions/29526990/is-there-a-security-vulnerability-to-permit-all-cors-origins-if-the-request-orig We had a requirement to permit cross-origin requests ...
0
votes
1answer
337 views

How to bypass XMLHttpRequest header protection for a CSRF attack

A client is only submitting forms using XMLHttpRequest with the use of a header (X-Header: [any value would be correct]) to protect against Cross Site Request Forgery attacks. I know this is not the ...
1
vote
1answer
158 views

Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?

Here is a test case from a recent application security asessment which I have had experienced: cookie = new Cookie(strKey1, EncryptDecrypt.encrypt(strValue)); cookie.setMaxAge(-1); ...
3
votes
1answer
297 views

How to fix open redirect vulnerability?

In redir.php: header("Location: {$_GET['addr']}"); For fixing open redirect vulnerability i can think of several ways: 1- (Side effect of) Using a security token (anti-csrf token): ...
0
votes
1answer
148 views

CSRF on GWT apps : bypassing the Same-Origin policy

At work we suspect a GWT app (that is not in production yet) we own to be vulnerable to CSRF. We have to look at it from a black-box point of view before a third-party security audit will be ...
11
votes
2answers
6k views

OAuth2 Cross Site Request Forgery, and state parameter

http://tools.ietf.org/html/draft-ietf-oauth-v2-30#section-10.12 says: The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the redirection URI ...
1
vote
4answers
808 views

Configure Firefox against malicious 302 redirect from a embedded image resource?

Today my friend demonstrated such a attack. I am using RenRen, a social networking website in a way very like Facebook in China. And I saw an article he wrote. Actually there is only an "image" ...
2
votes
1answer
100 views

Can you steal session cookie with BREACH attack?

Most of the discussions about the BREACH vulnerability are around stealing session-based CSRF tokens. But if you can steal a session-based token, could you also steal the session token itself? ...
2
votes
2answers
299 views

Why does this CSRF vulnerability work?

Recently Laravel 4 was updated to address a security concern: there was a CSRF vulnerability in their code. Here's the old code: if (Session::token() != Input::get('_token')) { throw new ...
0
votes
2answers
173 views

Are CSRF tokens useful outside of web APIs?

I'm trying to understand CSRF tokens and one thing isn't making sense to me. For a web API, you can provide a CSRF token just once, on authentication, and expect the client to remember that token ...
0
votes
1answer
107 views

OAuth + Confused Deputy + access token verification + state parameter

Google's "Using OAuth 2.0 for Client-side Application" article at https://developers.google.com/accounts/docs/OAuth2UserAgent states that the client MUST validate all access tokens to verify that it ...
1
vote
2answers
495 views

Should CSRF token without session cookie work?

Let's say that website example.com has CSRF protection. They send CSRF token in custom header and in hidden input fields. For example to add new folder, your http request need to contain CSRF token. ...
1
vote
2answers
69 views

CSRF Implementation

I am working on website,where I want include csrf checks by using referrer checks,will this be sufficient way to protect the form from csrf attack? if not what an attacker can do to bypass it?
3
votes
1answer
211 views

What constitutes an exploit? I was able to compromise my common household router

Was setting up Wifi at home today (just using the default router Time Warner Cable provides) and was appalled at the minimal security that the web server provides. Default user name/password is ...
2
votes
1answer
236 views

CSRF-protection using authentication token in HTTP header

I'm working on a web application which stores an authentication token in a cookie. The only CSRF-protection is referrer checking. I am considering improving this by moving the authentication token ...
2
votes
1answer
125 views

why application/json content type have csrf token?

If Json Applications are properly verifying the content type and have well configured crossdomain.xml, then why they still used csrf token? Could anybody tell me , why they use csrf token ? AFAIK, ...
0
votes
4answers
72 views

csrf attack when the victim not logged in

If an attacker sends a malicious code for state changing event to a victim and the victim opens that malicious link and clicks on the submit button, can the attack take place when the user is not ...