1

I am testing this application which sends JWT and CSRF token in cookies, I created a PoC file to test for CSRF, but only CSRF token is being sent in the PoC request and not JWT.

I was under the impression that cookies are always sent in all requests regardless of the domain sending those requests, this is the reason CSRF attacks are possible in the first place.

Why is JWT not being sent in CSRF PoC request?

Improve this question

2 Answers 2

Reset to default
1

Perhaps the cookies are marked as SameSite, or you are using a browser that has SameSite as default behavior.

Improve this answer
1
  • Your answer could be more precise, though. SameSite is only the attribute name. It's the value used (if any) that will determine the behaviour.
    – jub0bs
    Commented Mar 7, 2021 at 10:53
0

Cookie is the cookie and there is no difference what value is stored in it. It is only a string. You have to check all cookie attributes like: domain, path, flags.

From my experience first I would look for is secure flag. Often when developers are testing some feature on localhost they forget to use HTTPS with localhost (I do not recommend to set secure=false, as developers forgets sometimes about such things, and this can often be replicated to production environment).

Second flag is the SameSite which by default is set as "self" and if cookie used in cross-site request it disappears.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .