a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

learn more… | top users | synonyms

1
vote
1answer
44 views

Security concerns of HTML echo endpoint

Consider a website with an endpoint that, when a payload of an HTML string (full document or partial segment) is POST to it, the server will transform the payload (and sometimes no transform is ...
1
vote
1answer
69 views

CSRF tokens in Single Page Applications (JavaScript/Angular)

I have an AngularJS SPA served by Apache on a cheap web host. All communication to the backend is via Ajax REST calls to an expensive cloud server running Tomcat. How can the REST calls be protected ...
1
vote
1answer
3k views

Trying to reproduce a file upload compromise on Joomla

After telling my workmates and boss that we had a very critical lack of security controls, finally we got compromised! They had a Joomla 1.5 which was exploited using a file upload vulnerability. WSO ...
3
votes
0answers
74 views

How does github.com implement CSRF mitigation

I had a look into CSRF recently. The recommended mitigation strategy is to implement the Synchronizer Token Pattern. When you look at the details, the question comes up how often these tokens need to ...
2
votes
0answers
72 views

Is it secure to use one CSRF token multiple times?

I am new to the CSRF problem and I am studying how CSRF protection is implemented in popular applications like Facebook, Instagram etc. Now I am studying how CSRF protection is used in OAuth ...
2
votes
0answers
144 views

Astonishing Recent Belkin Router Auth Bypass Vulnerability: CSRF Used to Exploit?

I was visiting the CERT site main page today for another reason when I glanced at the list of recent vulnerability bulletins and came across some news I had somehow missed before today: a notice that ...
2
votes
0answers
125 views

Is it safe to store bearer tokens in an iframe and/or pass them back to the parent window

I am not a security expert, so I am hoping that a few of you might be able to tell me if there are any gaping flaws in the security design for my web app. Hopefully I'll be able to explain this ...
2
votes
0answers
301 views

Secure Single Page Application (SPA) served from a CDN

Is it possible to secure a Single Page Application (SPA) served from a CDN that communicates with a REST API, assuming the following: The front end communicates with a backend REST API using a token ...
1
vote
0answers
56 views

Is it okay to add CSRF synchronized token by modifying HTML from a valve/filter?

Is it okay to modify the html and add a hidden field containing the CSRF token to all the forms inside a page using a valve or a filter before going to the browser? I'm thinking on this line since I ...
1
vote
0answers
123 views

Oauth authentication without state parameter

I have some security concerns about the first step of account authentication in my application. The authentication goes through an OpenID provider. If the response of such provider shows that the ...
1
vote
0answers
202 views

Is there a security vulnerability to permit all CORS origins if the request origin matches a pattern?

Originally asked at: http://stackoverflow.com/questions/29526990/is-there-a-security-vulnerability-to-permit-all-cors-origins-if-the-request-orig We had a requirement to permit cross-origin requests ...
1
vote
0answers
259 views

CAS protection against CSRF attacks

A website based on Apache Struts uses central authentication service (cas) for login. I'd like to know if additional csrf protection needs to be provided with Struts in case cas doesn't provide that. ...
0
votes
0answers
121 views

Avoiding Client impersonation with Rest Api

I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For ...
0
votes
0answers
31 views

XSS script syntax problem

I have a server running on port 4444 on localhost that just echoes messages it receives. I have a JS script embedded in a message that is supposed to send the cookies of whoever looks at it. Here ...