7

Does it really make sense to use anti-CSRF tokens in a web application that is accessed by HTTPS only? If yes, then what are the possible ways to attack such a web application if anti-CSRF tokens are absent?

8

Yes, it does make sense. HTTPS does nothing to protect you against CSRF attacks. You would carry out an CSRF attack like you would against a HTTP enabled website.

Take a look at the CSRF description from OWASP to understand how it works. It will be obvious that the encryption of the communication channel is irrelevant for this type of attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.