I would have thought the domain name (including any subdomain) up through the trailing slash would be sufficient (like subdomain.example.com/ or subdomain.example.com:2082/), but I have seen references to checking the scheme as well.

  • 2
    I don't see a vector, but it can't hurt. keep in mind https sites reject http connections... – dandavis Jun 1 '17 at 2:36
  • Was getting false CSRF errors on sites that start as http and then change to https upon login. Wasn't sure if it was worth trying to code around this. – lindon Jun 1 '17 at 2:42
  • 1
    Agree with @dandavis - solely from the browser perspective I don't see using a scheme change to get CSRF. There might (and I'm uncertain here) be a context with custom schemes via compromised desktop or mobile app. – user18519 Jun 1 '17 at 2:44
  • @user18519: there's all kinds of vectors from such non-SOP useragents, but these aren't CSRF by definition, and such apps should not have cookie access anyway... – dandavis Jun 1 '17 at 2:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.