2

What is the risk for a form changing password with an old password input that doesn't have CSRF protection?

A form without an old password input, I understand the risk but if the old password input is present, what is the risk?

  • 1
    I think the answer to this is opinion based. If you want to be safe, add it as it shouldn't take much effort, assuming you need it anyway for other parts of the application. – Jeroen Apr 9 at 17:44
  • @Jeroen-ITNerdbox can the logic be bypassed though? – Vipul Nair Apr 9 at 19:11
  • 2
    @VipulNair I do not see an attack vector, the only thing I meant to say was since you already have an anti CSRF mechanism in place, why not add it for the sake of avoiding a discussion. It's not like it's going to "hurt". – Jeroen Apr 9 at 20:23
  • I prefer the principle "if it useless, don't use." – sushi Apr 9 at 21:06
2

You're on the correct train of thought, in that as long as there is an element to the request that is not guessable/shared between users CSRF isn't possible. The issue at the core of CSRF is that cookies are sent automatically by the browser, which is a problem when the cookies are the only part of the victim's request that an attacker doesn't know.

Depending on your application, there may be some cases where not having a CSRF token on your password change request opens up some surface area for an attacker. Assuming that an attacker has a user's password:

  • the attacker can CSRF the victim and change their password on your application, which would bypass 2 factor authentication.

  • if your service alerts users about suspicious logins (e.g. from new browsers/regions), CSRFing the password change would not trigger an alert.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.