I am trying to understand how one can prevent CSRF attacks. From what I have read and understood online, it seems to me that CSRF Tokens or using say the Origin header for CSRF prevention basically blocks all cross origin requests (specifically can be implemented only for those requests that change state such as POST)

Wouldn't this mean that even legitimate cross-origin requests would be blocked?

I just wanted to know if what I have understood is correct.

Thanks!

  • csrf tokens don't block anything, so no. – dandavis Jun 5 '17 at 3:12
up vote 0 down vote accepted

Wouldn't this mean that even legitimate cross-origin requests would be blocked?

Use of CSRF tokens and checking of Origin or Referer header does not simply block all cross site requests. It just means that only requests which have the proper CSRF token or which come from an acceptable Origin are allowed by the web application. Thus it also can be used to allow controlled cross-site execution if this is required.

  • okay. Thanks. So basically do you mean that certain Origins could be white listed too and hence you could have a more refined policy wherein you don't just reject all cross origin requests? – Kevin May 29 '17 at 4:43
  • @Kevin: Yes, that's what I mean. – Steffen Ullrich May 29 '17 at 5:00

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.