a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.
-1
votes
1answer
20 views
CSRF protection and Single Page Apps
I am in the process of writing a thick client web app using Angular.js (single page app) and was wondering what are the best practices for securing the app using a CSRF token.
Should I send a CSRF ...
2
votes
2answers
67 views
Is it safer to store the XSRF value inside your JavaScript?
To protect yourself against XSRF, you need to have a separate token on a page.
See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood
As the posting suggests, its best to have those ...
10
votes
5answers
419 views
CSRF protection with Session Id
To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent?
The server would then just ...
3
votes
1answer
65 views
Do websocket-powered web apps (e.g. “comet” apps) have to worry about CSRF?
The standard advice for HTTP applications wanting to prevent Cross Site Request Forgery is to include a random token on each state-changing request (usually POST) which is verified by the server ...
4
votes
3answers
148 views
Are CSRF Attacks Really Blind
I'm new to CSRF attacks but don't see how they are always blind.
Let's say we are dealing with a site where the asset we need to protect is the HTTP response. Something like SurveyMonkey or ...
9
votes
2answers
714 views
CSRF protection with custom headers (and without validating token)
For a REST-api it seems that it is sufficient to check the presence of a custom header to protect against CSRF attacks, e.g. client sends
"X-Requested-By: whatever"
and the server checks the ...
4
votes
2answers
126 views
Type 2 XSS vs CSRF
Trying to create a thorough understanding of XSS and CSRF, i'm clear that a type 2 xss involves an exploit that is persistent on the server.
e.g.
<SCRIPT type="text/javascript">
new ...
4
votes
2answers
84 views
How Secure are Authenticity Token in Rails
I came across a website which uses Rails Authenticity token to prevent CSRF attacks. My concern here is that I can see the authenticity token in the source code of the web page. If any other service ...
7
votes
3answers
182 views
What are the risk implications of not verifying referer header on login form?
Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to ...
5
votes
1answer
108 views
CSRF protection - 'back pages'
OWASP suggests that when implementing CSRF protection any attempt to go 'Back' in the browser will cause issues as Interaction with this previous page will result in a CSRF false positive security ...
11
votes
2answers
183 views
Why do browsers allow public websites to attack intranet sites?
When I'm visiting a website on the public internet, the website can cause my browser to send requests to a local IP address (such as 10.0.0.1). This can be used to attack internal web sites, e.g., ...
4
votes
4answers
5k views
Security issues using iframes
We are looking to move to iframes due to technical challenges. By moving to iframes it will be easier to manage the technical issues. But we are not totally sure of security implications of iframes.
...
1
vote
1answer
141 views
Anti-CSRF mechanism with referer header
This is not my main anti-CSRF mechanism; I know that https requests don't have a referer header; I know users or firewalls can remove it or set to an arbitrary fixed value.
I intend this mechanism ...
1
vote
2answers
307 views
storing anti-csrf token in cookie
I generate a random anti-csrf token per session and store it in a cookie (with http_only flag set); then add that token to forms (in hidden input field) and links.
when receiving a request on the ...
1
vote
1answer
152 views
CSRF with OAuth or Bearer Authorization headers
I am designing a RESTful API which is to be accessible from a web browser. The API is protected by Basic authentication.
I understand the concept of CSRF, and the mitigations proposed (I found both ...
2
votes
2answers
116 views
CSRF Login: can Attacker Login using valid credentials?
Considering this picture: taken from here:page21
Is this possible?
If so, How to prevent it?
0
votes
1answer
102 views
CSRF mitigation in MVC
I'm wondering about the best way to protect against CSRF in MVC or any other stateless web app. Due to the stateless nature, we can not keep a secret token in the session and compare it to the secret ...
7
votes
3answers
3k views
Does ASP.NET Viewstate implicitly prevent CSRF attacks? What does this mean for MVC?
If an encrypted ASP.NET Viewstate is submitted with every form, and control POST, does that mean that ASP.NET is less vulnerable to CSRF than other solutions with this?
What is the extent and ...
11
votes
4answers
4k views
What is the correct way to implement anti-CSRF form tokens?
I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet.
I've created tokens as a md5 of username, form info and a salt and stored it ...
3
votes
1answer
179 views
CodeIgniter CSRF confusion
I have been working with CodeIgniter for about 3 weeks and am very well on the way to loving this framework. However I have been looking at the core code of the framework and I was reading over the ...
0
votes
1answer
253 views
How about preventing CSRF this way?
According to Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet , the recommended solution to protect web site from CSRF attacking is to implement Synchronizer Token Pattern. And This requires ...
0
votes
1answer
231 views
Cookies + CSRF protection + AJAX
In my app (built in Codeigniter), users can submit status updates. When submitting forms, Codeigniter automatically provides a hidden cookie. I can validate that cookie through AJAX when the user ...
12
votes
1answer
520 views
Is Django's built-in security enough?
I have learned that Django provides built-in protection against the three main types of web app attacks (SQL injection, XSS and CSRF), which is really awesome.
Yet I have spoken to a few Django ...
5
votes
3answers
249 views
CSRF Countermeasures
I'm working through a book on web application security and it says that an effective CSRF countermeasure is to assign a temporary pseudo-random token to sensitive actions performed by authenticated ...
1
vote
2answers
1k views
header injection + codeigniter
I'm reading through Mozilla's Secure Coding Guidelines, and found this statement:
Don't trust any user data (input, headers, cookies etc). Validate it before using it
I'm using the codeigniter ...
1
vote
1answer
190 views
Is one CSRF token per session is adequate with HTTPS?
Ours is a Ajax heavy application with concurrent Ajax requests. Generating unique tokens with each request or expire and creation of new tokens after a certain interval could get tricky with multiple ...
2
votes
1answer
246 views
Burpsuite Pro: CSRF tokens in sequencer
So I'm using Burp to try and estimate the entropy used by tokens to prevent CSRF.
Let's say a website has a url in it's site protected by a Token:
<a ...
2
votes
2answers
327 views
How does a CSRF token prevent an attack, and how can I safely use/avoid it for my JSON API?
I'm trying to make an iOS app communicate with a Ruby on Rails website using JSON. While trying to post a login to create a user session, I discovered I was missing a CSRF token. I had no idea what ...
3
votes
1answer
169 views
How did the Tumblr worm spread?
Recently Tumblr was hit by a fast-spreading worm.
How did the worm work? What was the vulnerability in Tumblr that it exploired? Did it exploit a XSS vulnerability in Tumblr? A CSRF vulnerability ...
7
votes
2answers
1k views
CSRF With JSON POST
I am playing around with a test application which accepts JSON requests and response is also JSON. I am trying to do a CSRF for a transaction which accepts only JSON data with POST method in request. ...
4
votes
2answers
387 views
How to properly validate HTTP redirects?
I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads:
Validate data from redirects (An attacker may submit malicious ...
1
vote
1answer
128 views
Is there formal guidance that requires all sessions to be logged off when a user changes their password?
Often when an account is hacked, security guidance is to change your password. However I've noticed that changing a password sometimes isn't enough to log out of other sessions that are active.
Is ...
0
votes
3answers
89 views
Does AV software protect web applications (Twitter, Facebook, etc) from attacks? (CSRF, etc)
Is it correct to say that AV software focuses on downloaded executables and locally malicious activity, and it doesn't actively scan HTTP/S content for web based attacks such as CSRF, XSS, phishing ...
3
votes
2answers
281 views
CSRF protection for AJAX when using multiple browser tabs
Say I've got that web application that has a CSRF protection according to the Synchronizer Token Pattern. The server expects a valid CSRF token in each POST request when the user is authenticated. Now ...
6
votes
3answers
916 views
CSRF cookie vs session based tokens
I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie.
Is it ...
4
votes
2answers
236 views
CSRF Protection on static pages
I have a static site which has forms. The forms submit to a Rails endpoint which captures the submitted data. The static site and the Rails endpoint are on the same domain, on different subdomains and ...
9
votes
4answers
1k views
Why refresh CSRF token per form request?
In many tutorials and guides I see that an CSRF token should be refreshed per request, my question is why do I have to do this? Isn't a single CSRF token per session much easier than regenerating one ...
0
votes
2answers
184 views
CSRF over post request without redirection?
Is there a way to forge post request without being redirected to the page where parameters are submitted.For example :
<html>
<head>
<title>
CRSF example
</title>
...
4
votes
1answer
442 views
OAuth2 Cross Site Request Forgery, and state parameter
http://tools.ietf.org/html/draft-ietf-oauth-v2-30#section-10.12 says:
The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the redirection URI ...
4
votes
1answer
234 views
Ajax and CSRF protection
Without going into too much details I have a site which is 100% Ajax. All requests to the site (both GET and POST) are done via Ajax. Now I have to implement CSRF protection, and all the solutions I ...
5
votes
4answers
564 views
Protecting against CSRF when a form is being submitted via an AJAX call
I'm using anti-CSRF tokens on all my forms to prevent CSRF attacks. Also, the tokens are being saved in the $_COOKIE variable to validate against the value I get from the form. I'm resetting the token ...
3
votes
2answers
809 views
Why are CSRF tokens necessary?
It seems that the entire problem could be solved very elegantly by simply adding a new flag to the HTTP cookie specification.
Similarly to how cookies flagged Secure will only be submitted by the ...
1
vote
3answers
212 views
Why can I read the response to this CSRF attack?
I have a website www.foo.com:8002 that I have resolve to 127.0.0.1:8002 in my hosts file. I have another (the main site) running at localhost:80
In www.foo.com:8002 the page looks like
<form ...
6
votes
3answers
454 views
Web Browsers and Cross Origin Resource Sharing
The CORS spec states that if a request method and headers are not simple (http://www.w3.org/TR/cors/#simple-cross-origin-request) then a preflight HTTP OPTIONS request is sent to see if the request is ...
1
vote
2answers
647 views
How does ViewState protect against CSRF?
According to the OWASP CSRF Cheat Sheet viewStateUserKey for ASP.NET ViewState is acceptable to prevent csrf attacks, but I really don't get how. I get that this makes it hard for an attacker to ...
0
votes
1answer
154 views
Understanding CSRF vulnerability in Web Application?
I want to understand what is CSRF vulnerability. I use authorization system in my web application and found CSRF.
What should we do to solve it?
Actually I want to create simulation for this ...
10
votes
3answers
1k views
What risks do Cookieless sessions have? What are the mitigations?
I'm debating if I should support cookieless sessions in my web app. It would look something like this:
http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx
Since the URL is never ...
3
votes
1answer
256 views
OpenID Session Fixation with CSRF
This answer describes a situation where CSRF can be used to trick an end user to enter a credit card into another person's Paypal account. It also highlights the fact that state-changing GET requests ...
6
votes
7answers
534 views
Should I prevent sending of GET requests for urls that are normally operated with POST request?
There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
4
votes
1answer
180 views
Can anybody recommend any gems for checking security vulnerabilities?
I want to check one of my RoR projects for security vulnerabilities.
So can anybody recommend any gems for my needs?
