I'm working on testing CSRF protection for one of our webapps. We have a test case like the following:
<!DOCTYPE html> <html> <head> </head> <body> <form action="https://webapp.example.com/path/to/page.do" method="post"> <input type="hidden" name="actionTask" value="reject"> <input type="submit" value="Submit request"> </form> </body> </html>
Which is a simple page with a hidden field and submit button. If the user has a valid session (is logged into the web app), opens this CSRF page, and clicks "submit", the request is submitted and does bring the user to a results page in the web app.
This is a JSP-based web app that uses JSESSIONID to track the users session (plus cookies for auth). When I trace the HTTP methods, I see that Firefox (browser used to test) is in fact submitting JSESSIONID as one of the headers. How does Firefox obtain the correct value for JSESSIONID?
Note: I realize that since Firefox has a cookie for a valid session with the application, it can use that. But how does it determine JSESSIONID? I can log in and close the browser windows and the page still works as long as my session is still valid. Seems the server is telling the browser what its JSESSIONID is?
edit1: This question isn't specific to CSRF, but rather simply how the browser determines JSESSIONID when it has a valid session open.