If the application uses RESTful communication, does it need to have CSRF protection for PUT and DELETE requests? As per my understanding its not possible to trigger a PUT request using JavaScript and hence I would like to know if there is any exploitation possible with CSRF PUT..


It is possible to do PUT and DELETE using Javascript with XMLHttpRequest. But in when using these methods for a cross-origin request preflight request will be done to check if the server is willing to accept this cross-origin PUT/DELETE. Unless the server explicitly allows this request the actual PUT/DELETE will not be done. For more information about CORS and preflight requests see http://www.html5rocks.com/en/tutorials/cors/.

Note that in (older) browsers which do not support CORS XMLHttpRequest is restricted by the same origin policy. This means that the browser will not even attempt to send a cross-origin request this way and thus no CSRF is possible.

In summary: unless your server is configured to accept cross origin requests CSRF with PUT or DELETE is not possible.

  • Flash player ? – user2284570 Feb 18 at 23:15
  • @user2284570: I'm not really sure what you are trying to achieve with this short and link-only comment. But flash has a similar protection, i.e. one needs to have an appropriate crossdomain.xml file at the target to allow cross-site requests. – Steffen Ullrich Feb 19 at 3:17
  • With a 307 redirect you can make almost any request Flash player request can do anywhere (and always with cookies)… crossdomain.xml is about reading the resulting response not sending the data. – user2284570 Mar 12 at 23:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.