Does it really make sense to use anti-CSRF tokens in a web application that is accessed by HTTPS only? If yes, then what are the possible ways to attack such a web application if anti-CSRF tokens are absent?

1 Answer 1


Yes, it does make sense. HTTPS does nothing to protect you against CSRF attacks. You would carry out an CSRF attack like you would against a HTTP enabled website.

Take a look at the CSRF description from OWASP to understand how it works. It will be obvious that the encryption of the communication channel is irrelevant for this type of attack.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .