107 reputation
28
bio website
location
age
visits member for 1 year, 11 months
seen Dec 17 '12 at 20:59

Aug
27
comment Web Browsers and Cross Origin Resource Sharing
I agree with this, but I am mostly wondering if random clients who are browsing the web and are sent to a malicious website that plants a CSRF attack against them are safe. I guess there are older browsers that would not honor some of these safeguards, but I can't personally find one that does in this context
Aug
27
asked Web Browsers and Cross Origin Resource Sharing
Aug
24
awarded  Scholar
Aug
24
accepted CSRF cookie vs session based tokens
Aug
23
comment How does ViewState protect against CSRF?
So then the security of this is due to the fact that it's very hard to forge a valid viewstate since it is essentially equivalent to forging a session key?
Aug
23
comment How does ViewState protect against CSRF?
But the difference here with most csrf tokens is that it is validated server side against the session id... which in this case is submitted with the csrf attack. So as long as you didn't modify the view state you will be ok. And since post params aren't part of view state this seems like it wont be very effective
Aug
23
asked How does ViewState protect against CSRF?
Aug
23
comment CSRF cookie vs session based tokens
I am a bit confused. Why would the window of opportunity differ between a cookie or session value, assuming the csrf token is updated at the same frequency in either case?
Aug
23
awarded  Student
Aug
23
asked CSRF cookie vs session based tokens