0

I have a main website with an email subscription form. And my other websites where I have an email capture form. A user enters their email on those website and via POST he's redirected to the main website where an email he's entered is already pre-populad in a subscription form and where a user now has to click "Confirm to subscribe".

  1. Is this correct that there's little to no risk of getting attacked by CSRF? At the moment there's no authentication for users. In the future there it may or may not be added.

  2. When CSRF protection is turned on on my main website, all requests, of course, from my child websites to subscribe get rejected. Is this a correct behaviour and is there one details missing to make them come through?

Or should I turn CSRF protection off and is this how it usually is on other websites out there with the same functionality?

0

CSRF is only a threat when the request triggers some security-relevant action. If the request doesn't change anything or potentially expose any private data, it doesn't need CSRF protection. A POST request that just pre-populates a field isn't state-changing, if the user still needs to click "Confirm" before the server is updated. (Of course, the "Confirm" button would still need to have CSRF protection on it, though keep reading...)

Additionally, since the site is unauthenticated, CSRF protection probably isn't even needed. If there's no user-specific data or possible actions that aren't public to the whole world, then an attacker doesn't need to forge requests in somebody else's browser, because there's nothing the victim's browser can do that their own cannot. HOWEVER, if you are planning to add authentication, or if there's a "temporary session" thing where users enter some data that an attacker doesn't know, and the attacker wants to do something with that data other than what the user wants to do with it, then CSRF (and XSS) can still be threats.

Having CSRF protection disabled for specific requests is pretty common, though, when those requests don't change any persistent state or expose any data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.