If I'm browsing while I'm logged in into my hosting panel or router or any other application, there is a chance of being hacked by a CSRF exploit.

So, the question here is about user or client-side not server-side protection against CSRF attacks.

What can a user do in order to be safer? Maybe use two browsers, one for important accounts, another one for browsing?


Maybe use two browsers, one for those account, and another one for browsing?

This is a probably the best idea since it offers the most separation. This way classical session cookies will not be shared between sites, although a sharing of Silverlight and maybe Java or Flash based session ids might still happen. In most cases it will probably already be enough to start an instance of Firefox/Chrome in private/incognito mode.

But using another browser or browser profile for each sensitive site is not practical in all instances and one will probably do it only for some more sensitive sites like online banking or administration of the router. Apart from that valid cross site requests are in use for instance in single sign on setups (i.e. sign in with Facebook etc) or for using 3rd party payment providers like Paypal. For these cases there are several browser extensions which help dealing with CSRF and you will some examples at Wikipedia - CSRF - Client side safeguards.

  • Another more extensive separation would be to use two computers: one for browsing, and one fore sensitive activities like banking. Apr 17 '16 at 17:42
  • 2
    @BrentKirkpatrick: I agree that more separation is always better. But this kind of separation of using multiple systems (or VM) is usually not done to deal with CSRF but with malware which might infect the system. Apr 17 '16 at 17:46

One method is to use a private browsing window or Chrome Incognito session as these new browser instances do not share cookies with the rest of the browser, so therefore protection against CSRF is offered.

Bear in mind that these sessions do share cookies with each other, so it is recommended to close all private/incognito windows and relaunch when you are ready to log into a new site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.