Given the hypothetical situation:

  1. A user logs into his banking website
  2. The server returns a Http-only cookie containing the user's id, encrypted.
  3. On each request (such as when transferring funds), the server decrypts and checks the id.

No CSRF tokens are generated on any of the forms, and request validation is based on the encrypted id.

Is a CSRF attack possible under this scenario? If so, how would it work?

  • To really understand this, I'd encourage you to download a deliberately vulnerable app, like WebGoat, and try a CSRF exploit. If you're already tech-savvy this isn't too hard, and practical experience is the best kind of understanding. – paj28 Nov 7 '16 at 17:16

Yes, CSRF is still possible, and it works the same as CSRF would normally work.

The HTTP-only flag is useful for protected a cookie from an XSS attack which injects JavaScript to try to read the cookie and send it back to the attacker. For protecting against CSRF attacks, it is completely useless.

  • Browsers stop cookies from being sent from a different domain, so how would a different domain send the HTTP-only cookie? – Nathan Merrill Nov 7 '16 at 16:22
  • 2
    @NathanMerrill The other domain has a separate set of cookie which the browsers sends to it. The attacker doesn't need to know what the are, the browser sends them automatically. – Alexander O'Mara Nov 7 '16 at 16:23
  • So, if a form on attackerwebsite.com sends a POST request to mybank.com, the browser will attach all of the mybank.com cookies with it? – Nathan Merrill Nov 7 '16 at 16:25
  • @NathanMerrill Yep. – Alexander O'Mara Nov 7 '16 at 16:25
  • Another question: What's to stop malicious JS to request the page with the form on it, and parsing out the csrf token? – Nathan Merrill Nov 8 '16 at 15:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.