I am testing a website and observing the following behavior while intercepting and re-sending the request using postman.

  1. CSRF token is generated for each request
  2. User logs out. Generated CSRF token doesn't work
  3. User logs in. A new CSRF token is generated. But the old token is also still working.

What are the security implications this might have?

  • In steps 2 and 3, is is the same user? If user A's token works for user B (after A logs out and B logs in), that's likely a vuln. – CBHacking Sep 6 at 22:30

This looks like a sloppy design to me, that degrades performance by storing more tokens than necessary. But I don't see a security issue.

Why? To bypass the CSRF-filter the attacker would need to know the value of a token. But there is no leaking of that info in your example, just multiple tokens. Only difference is that an attacker has two in a billion instead of one in a billion chance of guessing it right.

One thing to investigate further, though: The CSRF token should be tied to the session. That it still works after login makes me suspicious. Does any CSRF token work with any session ID? Then you have no CSRF protection at all. Or doesn't the session ID change when you login? Then you have a session hijacking problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.