a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

learn more… | top users | synonyms

2
votes
2answers
39 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
2
votes
1answer
48 views

Random token and email confirmation key of 10 chars sufficient?

I have a function that returns random unguessable keys with the following characters: a-z A-Z 0-9. I have set the key length to 10 and I am using that for my form tokens to prevent CRSF and I will be ...
1
vote
1answer
238 views

Trying to reproduce a file upload compromise on Joomla

After telling my workmates and boss that we had a very critical lack of security controls, finally we got compromised! They had a Joomla 1.5 which was exploited using a file upload vulnerability. WSO ...
1
vote
0answers
66 views

Are HTTPOnly Cookies submitted via XmlHTTPRequest with withCredentials=True?

I have a two part question here. I have a javascript webapp accessing privileged REST endpoints. I would like to protect against CSRF. Currently, I have a login system built which returns a login ...