0

In a typical session riding scenario, the attacker tricks the victim into sending an HTTP request to a web site they are already logged in to. For example, tricking victim to click on a link to trigger a CSRF attack. The browser includes the session cookie (and all other cookies for that site) in the HTTP request, thus attacker can execute any - possibly malicious - operation victim is authorized to perform.

HTTPS encrypts the whole packet, thus making it impossible to read the content, including headers and cookies. But does it protect the user from session riding attacks, or will the browser still include the cookies and use correct encryption automatically?

Improve this question
1
  • No. If you are logged into examplebank.com and I convince you to click on link examplebank.com/transfer/?money=1000&to_acct=1234567 then $1000 will be transferred from your account to account 1234567 (assuming examplebank.com has such an API). This is why you should only use POST forms that require a CSRF token in the POST body to be included with the message.
    – dr jimbob
    Commented Jul 20, 2016 at 17:02

1 Answer 1

Reset to default
1

No because the browser dont change anything in the request when sending it over https (It will only encrypt it additionally). An attack with e.g. XSS will work exactly like it would work with http.

https only prevents from another type of attacks like man in the middle reading the session.

Improve this answer
1
  • Exactly. To prevent this session riding attack, the site in question would need CSRF Anti-Forgery Tokens in the forms.
    – d0nut
    Commented Jul 20, 2016 at 16:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .