2

I would like to note that I've read the other question with an embarrassingly similar title and it does not contain an answer to my question.

I have not used CodeIgniter as a programmer, but I have recently performed a penetration testing for a website that was using it. The site was very AJAX-heavy and as far as I understood it, it had CSRF protection in the form of a cookie (not marked httponly) that is copied into a hidden field of a form right before the form is submitted.

This automatically means if an attacker can find an XSS vulnerability in the website (as was the case), he can leverage it to achieve CSRF, too.

However, assuming the site is clear of XSS, is this solution inherently safe?
I feel pretty bad about an important cookie that is not httponly, and is by design accessed by JavaScript. Is it just me, or is this bad practice indeed?

I suppose that you cannot assume invulnerability to XSS as a defense, but still, is there any other attack on this (that does not leverage XSS)?

Improve this question
2
  • 1
    Assuming that the CSRF token isn't predictable, and there no XSS vulnerability, and the site is using SSL, then, as far as I can see, your assumption is correct. I cannot see anyway to attack this. I could be wrong, though.
    – Adi
    Commented Jun 9, 2013 at 1:07
  • 1
    XSS already gives you control of the user's browsing session on the site - if you've got that, you have no need of CSRF.
    – bobince
    Commented Jun 9, 2013 at 16:04

2 Answers 2

Reset to default
1

The difference between a httponly cookie and a non-httponly cookie is that the latter cannot be read or modified using JavaScript in the context of the website.

Having no XSS vulnerabilities implies that you cannot execute JavaScript in the context of the website you're attacking. Therefore, this solution is safe.

Improve this answer
-1

The XSS vulnerability may allow forms to be posted with or without CSRF cookies, but bear in mind that protection against XSS is not the purpose of CSRF protection.

Using CSRF cookies to protect yourself from XSS is like using a fire extinguisher to protect yourself from tornados. The fire extinguisher is useful, but it's useful for something different.

Improve this answer
1
  • 3
    -1 This doesn't answer the question. OP isn't asking about using CSRF cookies to protect against XSS. He's simply asking this: If the site has no XSS vulnerabilities, is a CSRF token in a non-httpOnly cookie enough to protect against CSRF.
    – Adi
    Commented Jun 9, 2013 at 12:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .