So say I've stored Facebook cookies, so that I don't have to login every time I visit Facebook. Would a CSRF attack on Facebook work(assuming they don't have CSRF protection), if I don't currently have a browser tab open logged into Facebook?

  • The key here is that any website can make you "visit" Facebook by issuing a cross-origin request that exploits a CSRF vulnerability in the background. (E.g. by loading Facebook in a hidden frame, as an image, via AJAX, etc.)
    – Arminius
    Commented Aug 1, 2017 at 2:27
  • Generally speaking having a session cookie stored is a requirement for CSRF. Commented Aug 2, 2017 at 15:27

1 Answer 1


Though there are some details that impact this, going by the general principles, the answer is YES.

An attack exploiting CSRF would attempt to execute some function of the target site (facebook, in your example) in the browser context.

So the key test is: If you open facebook in a tab (in the scenario you mentioned), would it give you a logged-in session directly. It appears that it would. In that case, it meets the conditions necessary to mount a CSRF attack.

There are many nuances. For example: Vulnerability != Exploit. i.e., though the attacker may get CSRF to work (and produce a POC to get a bug bounty or complete a VA/PT assignment) - there may be nothing there to exploit due to other protections. e.g., if additional auth is required to really do any damage.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .