Tag Info

New answers tagged

1

One reason for wanting to change the CSRF token per request is to mitigate compression leaking of the token. What I mean by that is that if the attacker Eve can inject data on a page containing the token where the page is sent compressed Eve can then guess at the first character of the string receiving a smaller dataset for the page knowing she guessed right ...


0

No - window.postMessage triggers a JavaScript event, not a HTTP request. The target window needs to be listening for the message. As noted on MDN: If you do not expect to receive messages from other sites, do not add any event listeners for message events. This is a completely foolproof way to avoid security problems. If you do expect to ...


1

One iframe does a GET on the page with the password and sends this password via html5 windows.postMessage() to another iframe (sourcing the attacker's site) which takes this password and sends it off to the hacker's site via a query parameter in an http get to a hacker's web service. postMessage is done with Javascript. This means one can not force a ...


3

1.Since the user is/might never authenticate in this application, do All forms/requests still need to be protected against CSRF? If not, in what case CSRF protection need to be implemented? If the user has some sort of confidential session state with the application, then CSRF is recommended. You may want to protect against CSRF for adding products to ...


0

Here is a very condensed breakdown on the differences between the Encrypted and Synchronizer Token patterns: The Encrypted Token Patterns does not require server-state It does not require cookies It does not require two tokens It does not require any effort on the client-side other than including the token in HTTP requests It does not require any other ...


1

This is a very similar method to using the X-Requested-With header, just that X-Header is used instead (neither of which are standard headers, although X-Requested-With could be considered a de-facto standard). This is a valid method of preventing CSRF as only the following headers are allowed cross domain: Accept Accept-Language Content-Language ...



Top 50 recent answers are included