a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.
16
votes
2answers
2k views
When the use of a AntiForgeryToken is not required /needed?
I'm running a rather large site with thousands of visits every day, and a rather large userbase.
Since I started migrating to MVC 3, I've been putting the AntiForgeryToken in a number of forms, that ...
14
votes
1answer
623 views
Is Django's built-in security enough?
I have learned that Django provides built-in protection against the three main types of web app attacks (SQL injection, XSS and CSRF), which is really awesome.
Yet I have spoken to a few Django ...
13
votes
4answers
4k views
What is the correct way to implement anti-CSRF form tokens?
I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet.
I've created tokens as a md5 of username, form info and a salt and stored it ...
12
votes
2answers
1k views
How to do Ajax securely?
This question is inspired by this security question http://security.stackexchange.com/questions/1707
What are the threats in using Ajax? (Please note I am talking about security threats, not ...
11
votes
2answers
191 views
Why do browsers allow public websites to attack intranet sites?
When I'm visiting a website on the public internet, the website can cause my browser to send requests to a local IP address (such as 10.0.0.1). This can be used to attack internal web sites, e.g., ...
10
votes
5answers
481 views
CSRF protection with Session Id
To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent?
The server would then just ...
10
votes
3answers
1k views
What risks do Cookieless sessions have? What are the mitigations?
I'm debating if I should support cookieless sessions in my web app. It would look something like this:
http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx
Since the URL is never ...
10
votes
4answers
1k views
Why refresh CSRF token per form request?
In many tutorials and guides I see that an CSRF token should be refreshed per request, my question is why do I have to do this? Isn't a single CSRF token per session much easier than regenerating one ...
9
votes
2answers
864 views
CSRF protection with custom headers (and without validating token)
For a REST-api it seems that it is sufficient to check the presence of a custom header to protect against CSRF attacks, e.g. client sends
"X-Requested-By: whatever"
and the server checks the ...
7
votes
3answers
3k views
Does ASP.NET Viewstate implicitly prevent CSRF attacks? What does this mean for MVC?
If an encrypted ASP.NET Viewstate is submitted with every form, and control POST, does that mean that ASP.NET is less vulnerable to CSRF than other solutions with this?
What is the extent and ...
7
votes
3answers
183 views
What are the risk implications of not verifying referer header on login form?
Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to ...
7
votes
2answers
1k views
CSRF With JSON POST
I am playing around with a test application which accepts JSON requests and response is also JSON. I am trying to do a CSRF for a transaction which accepts only JSON data with POST method in request. ...
7
votes
4answers
1k views
CSRF protection needed for clients that don't accept cookies?
I have recently updated a website from Django 1.0 to 1.3. One of the changes introduced was automatic protection against CSRF attacks. For the most part, this works great, but I have a problem with ...
6
votes
7answers
555 views
Should I prevent sending of GET requests for urls that are normally operated with POST request?
There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
6
votes
3answers
93 views
CSRF Token in GET request
According to the OWASP testing guide a CSRF token should not be contained within a GET request as the token itself might be logged in various places such as logs or because of the risk of shoulder ...
6
votes
3answers
478 views
Web Browsers and Cross Origin Resource Sharing
The CORS spec states that if a request method and headers are not simple (http://www.w3.org/TR/cors/#simple-cross-origin-request) then a preflight HTTP OPTIONS request is sent to see if the request is ...
6
votes
3answers
625 views
How should a web page respond to a CSRF attack?
I know that you use tokens to prevent CSRF, but how should the receiving page respond when it is attacked? Should it fail silently, pretending the transaction was successful? Display an error message? ...
6
votes
3answers
1k views
CSRF cookie vs session based tokens
I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie.
Is it ...
6
votes
2answers
196 views
Presentation on Web App Security (ACM Student Chapter)
I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding ...
6
votes
1answer
1k views
CSRF prevention in PHP
Two questions.
Where does one download the PHP version of OWASP's CSRF Guard? The following URL says to check Git:
https://www.owasp.org/index.php/PHP_CSRF_Guard
All I see on Git however is ...
5
votes
2answers
378 views
What is more secure: Many subdirectories, or many subdomains?
I have 3 websites that could be configured as a "VirtualApplication" in servicedefinition.csdef:
www.mydomain.net/enroll
www.mydomain.net/admin
www.mydomain.net/
... or I can configure them as a ...
5
votes
3answers
290 views
CSRF Countermeasures
I'm working through a book on web application security and it says that an effective CSRF countermeasure is to assign a temporary pseudo-random token to sensitive actions performed by authenticated ...
5
votes
2answers
186 views
Type 2 XSS vs CSRF
Trying to create a thorough understanding of XSS and CSRF, i'm clear that a type 2 xss involves an exploit that is persistent on the server.
e.g.
<SCRIPT type="text/javascript">
new ...
5
votes
1answer
114 views
CSRF protection - 'back pages'
OWASP suggests that when implementing CSRF protection any attempt to go 'Back' in the browser will cause issues as Interaction with this previous page will result in a CSRF false positive security ...
5
votes
1answer
531 views
OAuth2 Cross Site Request Forgery, and state parameter
http://tools.ietf.org/html/draft-ietf-oauth-v2-30#section-10.12 says:
The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the redirection URI ...
5
votes
4answers
593 views
Protecting against CSRF when a form is being submitted via an AJAX call
I'm using anti-CSRF tokens on all my forms to prevent CSRF attacks. Also, the tokens are being saved in the $_COOKIE variable to validate against the value I get from the form. I'm resetting the token ...
4
votes
3answers
164 views
Are CSRF Attacks Really Blind
I'm new to CSRF attacks but don't see how they are always blind.
Let's say we are dealing with a site where the asset we need to protect is the HTTP response. Something like SurveyMonkey or ...
4
votes
2answers
423 views
How to properly validate HTTP redirects?
I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads:
Validate data from redirects (An attacker may submit malicious ...
4
votes
1answer
448 views
How to prevent CSRF if you want to include Flash plugins in your form like Uploadify in your form?
What is CSRF?
I need a basic definition that is not just lifted from Wikipedia.
I understand SQL injection, XSS, cookie poisoning, but I just cannot wrap my mind around this.
I am using a ...
4
votes
1answer
184 views
Can anybody recommend any gems for checking security vulnerabilities?
I want to check one of my RoR projects for security vulnerabilities.
So can anybody recommend any gems for my needs?
4
votes
4answers
5k views
Security issues using iframes
We are looking to move to iframes due to technical challenges. By moving to iframes it will be easier to manage the technical issues. But we are not totally sure of security implications of iframes.
...
4
votes
1answer
193 views
CodeIgniter CSRF confusion
I have been working with CodeIgniter for about 3 weeks and am very well on the way to loving this framework. However I have been looking at the core code of the framework and I was reading over the ...
4
votes
2answers
247 views
CSRF Protection on static pages
I have a static site which has forms. The forms submit to a Rails endpoint which captures the submitted data. The static site and the Rails endpoint are on the same domain, on different subdomains and ...
4
votes
2answers
1k views
Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation
I'm hesitant to implement the proposed anti-JSON hijacking solutions since
The recommended solutions to mitigating JSON hijacking involve non-REST-full JSON POSTs to GET data
The alternate ...
4
votes
2answers
122 views
How Secure are Authenticity Token in Rails
I came across a website which uses Rails Authenticity token to prevent CSRF attacks. My concern here is that I can see the authenticity token in the source code of the web page. If any other service ...
4
votes
1answer
241 views
Ajax and CSRF protection
Without going into too much details I have a site which is 100% Ajax. All requests to the site (both GET and POST) are done via Ajax. Now I have to implement CSRF protection, and all the solutions I ...
4
votes
1answer
220 views
What are the implementation details and rationale of ASP.NET MVC3's AntiForgeryToken?
The AntiForgeryToken is used to prevent CSRF attacks, however the links on MSDN don't give me much insight to what exactly the AntiForgeryToken does, or how it works, or why things are done the way ...
3
votes
2answers
1k views
Why are CSRF tokens necessary?
It seems that the entire problem could be solved very elegantly by simply adding a new flag to the HTTP cookie specification.
Similarly to how cookies flagged Secure will only be submitted by the ...
3
votes
4answers
510 views
Can a CSRF CAPTCHA be defeated?
One defense that developers use to protect against a CSRF attack is to implement a CAPTCHA in critical steps. A CAPTCHA ensures that a human is at the keyboard approving the activity. But I've ...
3
votes
1answer
695 views
anti-CSRF tokens in HTTPS environment
Does it really make sense to use anti-CSRF tokens in a web application that is accessed by HTTPS only? If yes, then what are the possible ways to attack such a web application if anti-CSRF tokens are ...
3
votes
2answers
680 views
When should I not use CSRF protection for a form?
By default, I have CSRF protection for all my forms using a token.
However I noticed another web application that has a similar function to one of my forms. ANd they did not use CSRF token.
So I ...
3
votes
3answers
271 views
Protecting websites from outdated browsers and plugins via a whitelist/blacklist combination?
Aside from using browser headers, I want to blacklist/whitelist browser and plugins from my site so that I can prevent these older unpatched systems from (1) being a general user of my site (2) ...
3
votes
1answer
393 views
How does a CSRF token prevent an attack, and how can I safely use/avoid it for my JSON API?
I'm trying to make an iOS app communicate with a Ruby on Rails website using JSON. While trying to post a login to create a user session, I discovered I was missing a CSRF token. I had no idea what ...
3
votes
2answers
295 views
CSRF protection for AJAX when using multiple browser tabs
Say I've got that web application that has a CSRF protection according to the Synchronizer Token Pattern. The server expects a valid CSRF token in each POST request when the user is authenticated. Now ...
3
votes
1answer
263 views
OpenID Session Fixation with CSRF
This answer describes a situation where CSRF can be used to trick an end user to enter a credit card into another person's Paypal account. It also highlights the fact that state-changing GET requests ...
3
votes
1answer
81 views
Do websocket-powered web apps (e.g. “comet” apps) have to worry about CSRF?
The standard advice for HTTP applications wanting to prevent Cross Site Request Forgery is to include a random token on each state-changing request (usually POST) which is verified by the server ...
3
votes
1answer
179 views
How did the Tumblr worm spread?
Recently Tumblr was hit by a fast-spreading worm.
How did the worm work? What was the vulnerability in Tumblr that it exploired? Did it exploit a XSS vulnerability in Tumblr? A CSRF vulnerability ...
2
votes
2answers
67 views
Does CSRF work when the target site is not open on a tab?
This is an example attack scenario of OWASP for CSRF
The application allows a user to submit a state changing request that
does not include anything secret. For example:
...
2
votes
2answers
82 views
Is it safer to store the XSRF value inside your JavaScript?
To protect yourself against XSRF, you need to have a separate token on a page.
See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood
As the posting suggests, its best to have those ...
2
votes
2answers
119 views
CSRF Login: can Attacker Login using valid credentials?
Considering this picture: taken from here:page21
Is this possible?
If so, How to prevent it?
