107 reputation
17
bio website
location
age
visits member for 1 year, 7 months
seen Dec 17 '12 at 20:59

Aug
24
awarded  Scholar
Aug
24
accepted CSRF cookie vs session based tokens
Aug
23
comment How does ViewState protect against CSRF?
So then the security of this is due to the fact that it's very hard to forge a valid viewstate since it is essentially equivalent to forging a session key?
Aug
23
comment How does ViewState protect against CSRF?
But the difference here with most csrf tokens is that it is validated server side against the session id... which in this case is submitted with the csrf attack. So as long as you didn't modify the view state you will be ok. And since post params aren't part of view state this seems like it wont be very effective
Aug
23
asked How does ViewState protect against CSRF?
Aug
23
comment CSRF cookie vs session based tokens
I am a bit confused. Why would the window of opportunity differ between a cookie or session value, assuming the csrf token is updated at the same frequency in either case?
Aug
23
awarded  Student
Aug
23
asked CSRF cookie vs session based tokens