In a typical session riding scenario, the attacker tricks the victim into sending an HTTP request to a web site they are already logged in to. For example, tricking victim to click on a link to trigger a CSRF attack. The browser includes the session cookie (and all other cookies for that site) in the HTTP request, thus attacker can execute any - possibly malicious - operation victim is authorized to perform.

HTTPS encrypts the whole packet, thus making it impossible to read the content, including headers and cookies. But does it protect the user from session riding attacks, or will the browser still include the cookies and use correct encryption automatically?

  • No. If you are logged into examplebank.com and I convince you to click on link examplebank.com/transfer/?money=1000&to_acct=1234567 then $1000 will be transferred from your account to account 1234567 (assuming examplebank.com has such an API). This is why you should only use POST forms that require a CSRF token in the POST body to be included with the message.
    – dr jimbob
    Jul 20 '16 at 17:02

No because the browser dont change anything in the request when sending it over https (It will only encrypt it additionally). An attack with e.g. XSS will work exactly like it would work with http.

https only prevents from another type of attacks like man in the middle reading the session.

  • Exactly. To prevent this session riding attack, the site in question would need CSRF Anti-Forgery Tokens in the forms.
    – d0nut
    Jul 20 '16 at 16:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.