Tagged Questions
2
votes
2answers
106 views
CSRF protection and Single Page Apps
I am in the process of writing a thick client web app using Angular.js (single page app) and was wondering what are the best practices for securing the app using a CSRF token.
Should I send a CSRF ...
4
votes
2answers
423 views
How to properly validate HTTP redirects?
I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads:
Validate data from redirects (An attacker may submit malicious ...
1
vote
2answers
263 views
Does vulnerability exist when using XHR with GET method and custom anti-CSRF HTTP header?
Imagine button after clicking which browser sends XHR http request with GET method. Characteristics:
after executing request sensitive action is performed
sensitive information is sent in GET ...
6
votes
7answers
555 views
Should I prevent sending of GET requests for urls that are normally operated with POST request?
There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
-3
votes
2answers
394 views
Web service that converts HTTP GET to POST?
Is there some online forwarding service that I can give HTTP GET parameters to, and it would create a form with the parameters and submit it as POST?
For example, I'd like to give someone the URL:
...
