149 reputation
5
bio website
location
age
visits member for 1 year, 4 months
seen Aug 4 at 15:53

May
2
awarded  Popular Question
May
22
comment CSRF protection with Session Id
Cache-ability: my entire site is now cache-able, since the server doesn't need to cook this token into the returned HTML each time. I can now just use all static HTML & JS files...
May
21
awarded  Commentator
May
21
comment CSRF protection with Session Id
Of course, the anti-CSRF cookie value will just be overwritten/reset every time the user gets a new sessionid...
May
21
comment CSRF protection with Session Id
Because the CSRF cookie is submitted twice: (#1) once as a regular cookie (just a regular cookie w/o CSRF protection), but ALSO (#2) as a property dynamically added (at the same time) via the page's javascript into the body of every request from that page. The server will validate that the anti-CSRF token value passed via mechanism #1 (standard cookie mechanism) is the same as the one sent (at the same time) via mechanism #2 (the value of which only your page's javascript can access); if it's not the same or missing, the server will suspect CSRF.
May
20
awarded  Nice Question
May
19
awarded  Scholar
May
19
accepted CSRF protection with Session Id
May
19
answered CSRF protection with Session Id
May
16
comment CSRF protection with Session Id
So? You could then just keep your sessionid cookie "HttpOnly" and instead just use a separate non-HttpOnly anti-CSRF token cookie for my javascript mechanism.
May
14
comment CSRF protection with Session Id
Two disadvantages with this approach: (1) An XSS vulnerability will now allow the attacker to also get your session id --- since it's now just another field in the DOM. (2) No cache-ability; setting this hidden field value requires the server to dynamically generate the HTML since the HttpOnly sessionid cookie values are inaccessible from javascript. While #1 still applies to my approach, at least my approach resolves #2.
May
14
comment CSRF protection with Session Id
@Manishearth: the advantage with this javascript request interception/cookie reading is cache-ability -- everything is just a static HTML/JS resource. No dynamic server page generation required...
May
14
comment CSRF protection with Session Id
Can that token just be my session id?
May
14
awarded  Student
May
14
comment CSRF protection with Session Id
And what if the site doesn't have any inherent XSS vulnerabilities?
May
14
comment CSRF protection with Session Id
No it's CSRF protection since you're also validating that the cookie value is the same as the other value added to the request via the page's javascript. If it's not the same you've detected CSRF otherwise you are ok.
May
14
comment CSRF protection with Session Id
Because the attacker can't read my session id cookie value due to same-origin-policy, and won't likely guess it.
May
14
comment CSRF protection with Session Id
So what? I'll just make Javascript mandatory
May
14
asked CSRF protection with Session Id