I was just going through the OWASP's Cheat Sheet for CSRF Prevention. In the Double Submit Cookies method, I saw this the site should generate a (cryptographically strong) pseudorandom value ...
I was reading up on OWASP's page on CSRF and in their example they use a request where the sensitive parameters are stored in the query string: ...
I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding ...
I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine?
I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine? Edit Assume the web server has CSRF vulnerability. No hidden token checking ...
I'm running a rather large site with thousands of visits every day, and a rather large userbase. Since I started migrating to MVC 3, I've been putting the AntiForgeryToken in a number of forms, that ...
Should CSRF 'Double Submit Cookie' technique have a different seed value for the cookie versus the HTTP POST?
I'm reading about the OWASP double submit cookies method of protection and there it states that the cookie value between the header and form should match. That seems to be somewhat of a risk, as the ...
What is CSRF? I need a basic definition that is not just lifted from Wikipedia. I understand SQL injection, XSS, cookie poisoning, but I just cannot wrap my mind around this. I am using a ...
I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet. I've created tokens as a md5 of username, form info and a salt and stored it ...