1

I'm working on testing CSRF protection for one of our webapps. We have a test case like the following:

<!DOCTYPE html>
<html>
    <head>
    </head>
    <body>
        <form action="https://webapp.example.com/path/to/page.do" method="post">
            <input type="hidden" name="actionTask" value="reject">
            <input type="submit" value="Submit request">
        </form>
    </body>
</html>

Which is a simple page with a hidden field and submit button. If the user has a valid session (is logged into the web app), opens this CSRF page, and clicks "submit", the request is submitted and does bring the user to a results page in the web app.

This is a JSP-based web app that uses JSESSIONID to track the users session (plus cookies for auth). When I trace the HTTP methods, I see that Firefox (browser used to test) is in fact submitting JSESSIONID as one of the headers. How does Firefox obtain the correct value for JSESSIONID?

Note: I realize that since Firefox has a cookie for a valid session with the application, it can use that. But how does it determine JSESSIONID? I can log in and close the browser windows and the page still works as long as my session is still valid. Seems the server is telling the browser what its JSESSIONID is?

edit1: This question isn't specific to CSRF, but rather simply how the browser determines JSESSIONID when it has a valid session open.

  • 1
    I don't understand what your question has to do with CSRF? Am I missing something here? – Anders May 23 '16 at 19:47
  • 1
    @Anders I think the HTML code is an example CSRF payload. To me, the question seems to be about how cookies work (how the browser gets the cookie value, how the browser knows where and when to send which cookie(?)), which would probably make it off-topic (or maybe a duplicate of some other CSRF question), but I may also be misunderstanding something. – tim May 23 '16 at 19:59
  • Yes, sorry, now that I think about the question deeper, it is not specific to CSRF. Just how cookies/headers work. Sorry about that. Should I edit the title? – Exit42 May 23 '16 at 20:18
  • No problem! If you feel you can make the question clearer that it is always a good thng to edit it, even if you already have nice answers. – Anders May 23 '16 at 20:31
0

But how does it determine JSESSIONID? I can log in and close the browser windows and the page still works as long as my session is still valid. Seems the server is telling the browser what its JSESSIONID is?

The server sends JSESSIONID to the browser in an http response with a set-cookie header.

Here is an example:

HTTP/1.1 302 Found
Server: nginx/1.4.6 (Ubuntu)
Date: Mon, 23 May 2016 19:48:35 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Location: https://freezerpro/signin
X-UA-Compatible: IE=Edge,chrome=1
Cache-Control: no-cache
Set-Cookie: JSESSIONID=3a64adc78f2dae266c99767c6686bc0d; path=/; HttpOnly
X-Request-Id: d09eafd83135da8ad1f261d67d380c84
X-Runtime: 0.008982
X-Rack-Cache: miss
Content-Length: 95

And then the next request from the browser to the server has that same sessionID, linking it to the already established session:

GET /signin HTTP/1.1
Host: freezerpro
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cookie: JSESSIONID=3a64adc78f2dae266c99767c6686bc0d
DNT: 1
Connection: close 
0

Correct me if I misunderstood the question.But here's what I have understood. Browser sends all the cookie values to the server when you open this HTML. This is the default nature of browser to append all the cookies with the request. If browser has some cookies of a particular host, it will send these with every request pointing to the same host.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.