What is the risk for a form changing password with an old password input that doesn't have CSRF protection?

A form without an old password input, I understand the risk but if the old password input is present, what is the risk?

  • 1
    I think the answer to this is opinion based. If you want to be safe, add it as it shouldn't take much effort, assuming you need it anyway for other parts of the application.
    – Jeroen
    Commented Apr 9, 2019 at 17:44
  • @Jeroen-ITNerdbox can the logic be bypassed though?
    – yeah_well
    Commented Apr 9, 2019 at 19:11
  • 2
    @VipulNair I do not see an attack vector, the only thing I meant to say was since you already have an anti CSRF mechanism in place, why not add it for the sake of avoiding a discussion. It's not like it's going to "hurt".
    – Jeroen
    Commented Apr 9, 2019 at 20:23
  • I prefer the principle "if it useless, don't use."
    – salt
    Commented Apr 9, 2019 at 21:06

1 Answer 1


You're on the correct train of thought, in that as long as there is an element to the request that is not guessable/shared between users CSRF isn't possible. The issue at the core of CSRF is that cookies are sent automatically by the browser, which is a problem when the cookies are the only part of the victim's request that an attacker doesn't know.

Depending on your application, there may be some cases where not having a CSRF token on your password change request opens up some surface area for an attacker. Assuming that an attacker has a user's password:

  • the attacker can CSRF the victim and change their password on your application, which would bypass 2 factor authentication.

  • if your service alerts users about suspicious logins (e.g. from new browsers/regions), CSRFing the password change would not trigger an alert.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .