I've been reading about CSRF and how it works, and, if I understood correctly, the 'only' thing an attacker can do is force the user to perform actions he didn't intend.

I understand the danger if we have a service such as /moneytransfer?from=user&to=attacker.

However, if a service merely updates the user's cookie values, then CSRF would give nothing to the attacker, correct? Is there some danger of the attacker to glimpse cookie OR response content without XSS? Would CSRF protection even be needed in such a case?


I apologize, I'm afraid I didn't make myself too clear...

Let's say I have a cookie with a session ID. Each time the user accesses the service:


... he gets back a cookie with Auth-Cookie=#SessionId.

For authentication, instead of the cookie, the server would expect the session in an HTTP Header, such as:

HTTP-AUTH: #SessionId

In such a case, a call to the /getSession service by an attacker would simply give the user a new session cookie.

In a scenario like this, would CSRF ever be a danger?

(This is all hypothetical, I know there are much better ways to make authentication. I'm a newcomer to security, and I'm just really trying to understand the limits of CSRF, and which types of service would need protection).


CSRF mainly intends to leverage already authenticated sessions. So if there is any workable method without use of Random CSRF tokens to validate with the server, it can be worked by the attacker as well. You can also use the Origin and Referer header and challenge response as suggested in OWASP Cheat Sheet (https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet)


The attacker is still able to make POST requests if he can inject some javascript, therefore retrieving the response to the /getSession. Please take a look at OWASP and this Blog post to learn how to prevent CSRF attacks.


The main point of CSRF is forcing client browser to send HTTP request without client intend. Actually, the cookie update frequency is not an important topic for CSRF exploitation. Whether cookie update is happening so quickly or not, client browser will use latest one. Because of targeted client gonna be the only ONE! who will be forced by attacker to send special HTTP request to the application.

There is no way to see cookie or response of the HTTP request during the basic CSRF vulnerability exploitation.

Image that you are a victim and you are visiting a website.com that under the hacker control. Website.com will send following

<img src="https://bank.com/api/disableMyAccount"></img>

You browser will send GET to the above URL in order to serve image content. If you have a valid session before visiting website.com. You account will be disabled, which is not your intend. As you can see, we haven't seen any cookie or response content during victim bank.com visits.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.