First of all, I'm quite new to web security so this might be a dumb question. Also English is not my native language so there might be some errors.

I understand that by having a csrf token as a hidden parameter in a form or HTTP header, an attacker cannot use something like an image tag to perform an action on the user's behalf. I also understand that if you have an XSS on the website, you can steal the csrf token and perform any action.

What I don't understand however is what prevent an attacker to his own domain, like evilsite.com, use JavaScript to make a GET request, analyses the response, extract the csrf token and submit the form to make some action. As you can make a post request with JQuery for example, you should be able to send the request and trick the user.

There should be a mechanism that I don't understand here because it makes no sense for me right now. What don't I understand?

  • 1
    The best answer: try to do it yourself! It's not a hard experiment and you'll learn a lot. – Conor Mancone Aug 13 '19 at 23:58

Same-origin policy prevents a website from reading another website, which also prevents it from extracting the token to perform a CSRF attack.

|improve this answer|||||
  • 1
    So if I understand this correctly, we have to trust the browser as this is client-side. Am I right? – o2640110 Aug 14 '19 at 0:19
  • @o2640110: That's right. – Benoit Esnard Aug 14 '19 at 0:21
  • Is there a way to do a server-side check to add further protection? (Other than the csrf token) – o2640110 Aug 14 '19 at 9:35
  • @o2640110 Some people check the referer, but an attacker could force the browser to not send that header. Note that the CSRF provides enough protection already. – Benoit Esnard Aug 14 '19 at 9:38
  • Thanks a lot for all your answers. – o2640110 Aug 14 '19 at 14:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.