a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

learn more… | top users | synonyms

29
votes
2answers
6k views

When the use of a AntiForgeryToken is not required /needed?

I'm running a rather large site with thousands of visits every day, and a rather large userbase. Since I started migrating to MVC 3, I've been putting the AntiForgeryToken in a number of forms, that ...
22
votes
1answer
3k views

Is Django's built-in security enough?

I have learned that Django provides built-in protection against the three main types of web app attacks (SQL injection, XSS and CSRF), which is really awesome. Yet I have spoken to a few Django ...
16
votes
4answers
8k views

What is the correct way to implement anti-CSRF form tokens?

I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet. I've created tokens as a md5 of username, form info and a salt and stored it ...
16
votes
3answers
756 views

Protecting Health Care Database

I am doing a minor project on information security in which i am implementing techniques listed below to protect a HEALTH CARE database. Preventing SQL Injection (using prepared ...
14
votes
5answers
2k views

Why does an anti-forgery token need so many bits?

In https://developers.google.com/accounts/docs/OAuth2Login#createxsrftoken Google recommends using a 130-bit cryptographically-secure random number as an anti-forgery token. Why do we need so many ...
14
votes
4answers
5k views

Why refresh CSRF token per form request?

In many tutorials and guides I see that an CSRF token should be refreshed per request, my question is why do I have to do this? Isn't a single CSRF token per session much easier than regenerating one ...
14
votes
3answers
468 views

Why CSRF Token has to be a Cryptographically Strong Random number, in Double Submit Cookies method?

I was just going through the OWASP's Cheat Sheet for CSRF Prevention. In the Double Submit Cookies method, I saw this the site should generate a (cryptographically strong) pseudorandom value ...
13
votes
3answers
3k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
13
votes
4answers
5k views

CSRF protection with custom headers (and without validating token)

For a REST-api it seems that it is sufficient to check the presence of a custom header to protect against CSRF attacks, e.g. client sends "X-Requested-By: whatever" and the server checks the ...
13
votes
2answers
27k views

Why is the Access-Control-Allow-Origin header necessary?

I understand the purpose of the Access-Control-Allow-Credentials header, but can't see what problem the Access-Control-Allow-Origin header solves. More precisely, it's easy to see how, if ...
12
votes
2answers
2k views

How to do Ajax securely?

This question is inspired by this security question http://security.stackexchange.com/questions/1707 What are the threats in using Ajax? (Please note I am talking about security threats, not ...
12
votes
2answers
286 views

Why do browsers allow public websites to attack intranet sites?

When I'm visiting a website on the public internet, the website can cause my browser to send requests to a local IP address (such as 10.0.0.1). This can be used to attack internal web sites, e.g., ...
10
votes
5answers
1k views

CSRF protection with Session Id

To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent? The server would then just ...
10
votes
4answers
433 views

How to protect against login CSRF?

http://seclab.stanford.edu/websec/csrf/csrf.pdf points out that most CSRF protection mechanisms fail to protect login forms. As http://stackoverflow.com/a/15350123/14731 explains: The ...
9
votes
2answers
3k views

OAuth2 Cross Site Request Forgery, and state parameter

http://tools.ietf.org/html/draft-ietf-oauth-v2-30#section-10.12 says: The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the redirection URI ...
8
votes
2answers
6k views

Does ASP.NET Viewstate implicitly prevent CSRF attacks? What does this mean for MVC?

If an encrypted ASP.NET Viewstate is submitted with every form, and control POST, does that mean that ASP.NET is less vulnerable to CSRF than other solutions with this? What is the extent and ...
8
votes
2answers
500 views

Is Django's built-in CSRF protection enough?

Django sets a CSRF protection token on the user's machine via a cookie. It then asks for the token on POST requests. If these two don't match, it returns a 403. If I change manually both the cookie ...
8
votes
3answers
1k views

CSRF Token in GET request

According to the OWASP testing guide a CSRF token should not be contained within a GET request as the token itself might be logged in various places such as logs or because of the risk of shoulder ...
8
votes
2answers
803 views

Type 2 XSS vs CSRF

Trying to create a thorough understanding of XSS and CSRF, i'm clear that a type 2 xss involves an exploit that is persistent on the server. e.g. <SCRIPT type="text/javascript"> new ...
7
votes
3answers
330 views

What are the risk implications of not verifying referer header on login form?

Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to ...
7
votes
2answers
4k views

CSRF With JSON POST

I am playing around with a test application which accepts JSON requests and response is also JSON. I am trying to do a CSRF for a transaction which accepts only JSON data with POST method in request. ...
7
votes
3answers
1k views

How should a web page respond to a CSRF attack?

I know that you use tokens to prevent CSRF, but how should the receiving page respond when it is attacked? Should it fail silently, pretending the transaction was successful? Display an error message? ...
7
votes
3answers
4k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
7
votes
2answers
154 views

Are my session settings secure enough?

I'm developing a file hosting and sharing web application. Are the following PHP session settings secure enough? ini_set('session.cookie_httponly', 1); ini_set('session.cookie_lifetime', 0); ...
6
votes
7answers
872 views

Should I prevent sending of GET requests for urls that are normally operated with POST request?

There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
6
votes
4answers
2k views

CSRF protection needed for clients that don't accept cookies?

I have recently updated a website from Django 1.0 to 1.3. One of the changes introduced was automatic protection against CSRF attacks. For the most part, this works great, but I have a problem with ...
6
votes
3answers
1k views

Web Browsers and Cross Origin Resource Sharing

The CORS spec states that if a request method and headers are not simple (http://www.w3.org/TR/cors/#simple-cross-origin-request) then a preflight HTTP OPTIONS request is sent to see if the request is ...
6
votes
2answers
706 views

Are RESTful sites safe against CSRF attacks?

I am having a debate with a coworker about whether our site is vulnerable to CSRF attacks. He is saying that since we are using RESTful AJAX requests for everything that CSRF is not possible. Say a ...
6
votes
2answers
2k views

What is the purpose of OAuth 2.0 redirect_uri checking?

The OAuth 2.0 specification's authorization code mechanism includes redirect URI checking from the site you redirect to. See steps D and E in section 4.1 of the spec. Also, section 4.1.3 describes in ...
6
votes
2answers
2k views

CSRF protection and Single Page Apps

I am in the process of writing a thick client web app using Angular.js (single page app) and was wondering what are the best practices for securing the app using a CSRF token. Should I send a CSRF ...
6
votes
2answers
236 views

Presentation on Web App Security (ACM Student Chapter)

I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding ...
6
votes
1answer
2k views

CSRF prevention in PHP

Two questions. Where does one download the PHP version of OWASP's CSRF Guard? The following URL says to check Git: https://www.owasp.org/index.php/PHP_CSRF_Guard All I see on Git however is ...
5
votes
2answers
621 views

What is more secure: Many subdirectories, or many subdomains?

I have 3 websites that could be configured as a "VirtualApplication" in servicedefinition.csdef: www.mydomain.net/enroll www.mydomain.net/admin www.mydomain.net/ ... or I can configure them as a ...
5
votes
3answers
350 views

Are CSRF Attacks Really Blind

I'm new to CSRF attacks but don't see how they are always blind. Let's say we are dealing with a site where the asset we need to protect is the HTTP response. Something like one's medical history. ...
5
votes
4answers
10k views

Security issues using iframes

We are looking to move to iframes due to technical challenges. By moving to iframes it will be easier to manage the technical issues. But we are not totally sure of security implications of iframes. ...
5
votes
3answers
865 views

CSRF Countermeasures

I'm working through a book on web application security and it says that an effective CSRF countermeasure is to assign a temporary pseudo-random token to sensitive actions performed by authenticated ...
5
votes
1answer
156 views

CSRF protection - 'back pages'

OWASP suggests that when implementing CSRF protection any attempt to go 'Back' in the browser will cause issues as Interaction with this previous page will result in a CSRF false positive security ...
5
votes
2answers
791 views

CSRF protection for AJAX when using multiple browser tabs

Say I've got that web application that has a CSRF protection according to the Synchronizer Token Pattern. The server expects a valid CSRF token in each POST request when the user is authenticated. Now ...
5
votes
2answers
515 views

Ajax and CSRF protection

Without going into too much details I have a site which is 100% Ajax. All requests to the site (both GET and POST) are done via Ajax. Now I have to implement CSRF protection, and all the solutions I ...
5
votes
4answers
1k views

Protecting against CSRF when a form is being submitted via an AJAX call

I'm using anti-CSRF tokens on all my forms to prevent CSRF attacks. Also, the tokens are being saved in the $_COOKIE variable to validate against the value I get from the form. I'm resetting the token ...
4
votes
3answers
130 views

Does CSRF work when the target site is not open on a tab?

This is an example attack scenario of OWASP for CSRF The application allows a user to submit a state changing request that does not include anything secret. For example: ...
4
votes
2answers
1k views

How to properly validate HTTP redirects?

I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads: Validate data from redirects (An attacker may submit malicious ...
4
votes
2answers
1k views

When should I not use CSRF protection for a form?

By default, I have CSRF protection for all my forms using a token. However I noticed another web application that has a similar function to one of my forms. ANd they did not use CSRF token. So I ...
4
votes
1answer
594 views

How to prevent CSRF if you want to include Flash plugins in your form like Uploadify in your form?

What is CSRF? I need a basic definition that is not just lifted from Wikipedia. I understand SQL injection, XSS, cookie poisoning, but I just cannot wrap my mind around this. I am using a ...
4
votes
1answer
173 views

Possible to submit multiple POST requests using CSRF?

I am aware that you can execute a POST request using CSRF using the method below: <form name="x" action="http://site/index/dosomething" enctype="text/plain" method="post"> <!-- stuff ...
4
votes
2answers
281 views

Can anybody recommend any gems for checking security vulnerabilities?

I want to check one of my RoR projects for security vulnerabilities. So can anybody recommend any gems for my needs?
4
votes
1answer
681 views

CSRF prevention for RESTful services

Am I right If I claim on that there doesn't exist any reliable protection against CSRF for a stateles environment today? I have a RESTful service (build with RESTEasy) that needs to be secured against ...
4
votes
1answer
571 views

CodeIgniter CSRF confusion

I have been working with CodeIgniter for about 3 weeks and am very well on the way to loving this framework. However I have been looking at the core code of the framework and I was reading over the ...
4
votes
2answers
477 views

CSRF Protection on static pages

I have a static site which has forms. The forms submit to a Rails endpoint which captures the submitted data. The static site and the Rails endpoint are on the same domain, on different subdomains and ...
4
votes
2answers
1k views

Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation

I'm hesitant to implement the proposed anti-JSON hijacking solutions since The recommended solutions to mitigating JSON hijacking involve non-REST-full JSON POSTs to GET data The alternate ...