Tag Info

New answers tagged

0

"Secure enough to use" -- secure enough to use for what? Are you a bank? Healthcare website? The "secure enough" question needs context and and understanding of your appetite for risk. If you sell $2 widgets and you're a daredevil then 10 charters is fine. If you're running something more sensitive and a 10-character token is going to keep you up at ...


0

Really, two requests for each task is a performance overhead. You can simply achieve this using single request. You can simply validate the token during POST request, and send back the new token with each request. Using JS make sure you pick up the latest cookie value and attach it to every request AJAX sent. In fact if you want to cut off your pain in CSRF ...


1

CSRF would still be possible if you are using HTTP Basic or HTTP Digest authentication. The reason is that browsers implement those protocols "natively", meaning the browser will automatically insert the credentials with every request going to a particular domain. If you are using some other form of authentication without cookies, then CSRF isn't possible. ...


3

Yes you should protect against Login CSRF. Without this protection an attacker can effectively reverse a CSRF attack. Rather than the victim being logged in to their own account and the attacker tries to ride the session by making requests to the site using the victim's cookies, they will be logging into the site under the attacker's credentials allowing the ...


0

If the CSRF vulnerable application allows itself to be embedded in an Iframe, then yes. How does it help the attacker? Iframes can be made invisible by setting size to zero. So as against the normal csrf where victim might get an idea of something suspicious, in case of invisible iframe, he won't see anything. The attacker will submit the form on victim's ...


1

Login? Yes. Logout? No. Why login? There is this funny CSRF login attack, where the attacker logs in the victim under aa attacker-controlled account, and then can "gain control over content created by the victim while logged in under that account". The impact is pretty lame IMO, but they started to see this as a problem now that more juicy attack vectors ...



Top 50 recent answers are included