Tag Info

New answers tagged

1

See http://hueniverse.com/2011/06/21/oauth-2-0-redirection-uri-validation/: Consider the following scenario: Evil user starts the OAuth flow on a legitimate client using the authorization code grant type flow. Client redirects the evil user to the authorization server, including state information about the evil user account on the client. ...


2

What's the content of your website? Is it anything anyone anywhere in the world could want to access without other people knowing about it (governments, marketers, snoops on the same wifi network)? Remember that what might be perfectly acceptable to view in your culture might not be acceptable elsewhere (like opinions about politics, sexuality or religion). ...


4

Is HTTPS needed in this case? In every case that I can think of HTTPS is beneficial. The trivial case is if you don't have sessions, why would you need a secure connection if there are no sessions and everything is public? Having a secure connection actually helps your Google PageRank, and it also helps the user feel more secure by visiting your site ...


1

Using custom headers to mitigate CSRF does work, however, this isn't considered best practice. Best practice is to include a CSRF token as a parameter in all state changing requests to ensure the request is from within the domain. The main concern for using custom headers to mitigate CSRF is that it's unknown if in the future an attacker will be able to send ...


1

Yes, there's no problem with using the same CSRF token since it is already sharing the same auth token. As long as the token is regenerated per new session and both the API and the APP check that the CSRF token is associated with that particular session then this should mitigate CSRF.


1

There are several non-malicious reasons why an Referer header might be empty: the URL was accessed from a bookmark, from inside a mail or the URL was simply typed into the browser support for Referer was disabled in the browser or Referer got stripped by a firewall Apart from that the Referer might be disabled by a noreferrer attribute in links, by ...


1

The referrer may be used as an indication that some other website directly link to your content. You may want to trigger some restrictions (or simply log) when you encounter a referrer pointing to a different website than your own for bandwidth or copyright purposes. However, you must not assume that every browser will send you a "referer" header. The RFC ...


1

Usability Yes, some people do not send referers. This may be for privacy reasons, or for security reasons (URLs should not contain sensitive data such as session ids, but that doesn't mean that they never do). Security If your website has an open redirect vulnerability, referer checks can be bypassed for GET requests. Of course, GET requests should not ...


1

I'd say that using, lack of, referrer as the sole indicator of an attack is likely to be troublesome as you can't be sure that all clients will send it as expected. In general using referrer as a protection against CSRF isn't considered a good idea as it can be spoofed under some circumstances. If there were no other options then it might be worth using, ...


0

CSRF tokens are unique for each user and stored on either the server or client side. This means an attacker would have to guess the value of your CSRF token to attack you. If the token is generated using a cryptographically secure PRNG, a basic attack like you describe is not possible.


0

Yes, Wordpress nonces can protect against login CSRF. Wordpress nonces can be applied to URLs and also forms, like the login form: To add a nonce to a form, call wp_nonce_field() specifying a string representing the action. By default wp_nonce_field() generates two hidden fields, one whose value is the nonce and one whose value is the current URL ...


2

First of all, thanks for the interesting question. I did not know about the details of CSRF before and had to look up the answer to your question myself, but I think I know the correct explanation for Django's behavior now. The Django developers are treating HTTP and HTTPS refers differently because users expect different things from insecure and secure web ...


3

The reason that sites are able to impersonate users performing actions is because browsers will willingly submit a HTML <form> to any other domain specified using the action attribute without concern the origins being the same or any other restrictions provided by the target domain. The original domain has no way to read what was received by the user ...


2

Without the token check, the attacker wouldn't even need to inject javascript. For example, they create a form on https://evil.example/ that submits to an action at https://target.example/. Instead of injecting javascript on the target site, they can just place it directly on the site they control and trick you to visit that. The POST request will still ...


2

I'm not an expert on CSRF (please comment if I have misconceptions), but from wikipedia: Under the [same-origin policy], a web browser permits scripts contained in a first web page to access data in a second web page, but only if both web pages have the same origin. An origin is defined as a combination of URI scheme, hostname, and port number. A ...


5

If the attacker is good enough to make me submit a form (as mentioned by OWASP) what would prevent him from getting the token before submitting? The only skill an attacker needs to have is the ability to write HTML and javascript and know what the request they are trying to attack looks like. These are all things that are easily accessible and are ...


1

CSRF Protection on Logout is a must ! Why? Assume the following scenario: You're on a trading page and prepare a buying order for e.g. 1000 Daimlers on an Exchange XETRA. Until you are preparing the order, somebody, who knows that you are logged on https://anybrokerpage.com/ , sends a phishing link to you. e.g. https://anybrokerpage.com/logout By ...



Top 50 recent answers are included