I am able to make cross site requests because I have enabled CORS. I read about CSRF vulnerability which is caused by the fact that browser sends cookie when making a form POST request.

I tried to exploit my website to see if it works. Therefore, I tried with something simple first. I sent a cross-site GET request but no cookie was sent. So, my question is do browsers not send cookies at cross site GET request or is it that I did something wrong?

  • 2
    Are you setting .withCredentials to True in your cross-site request? – mti2935 Mar 25 '20 at 14:50
  • 2
    Most CSRF articles will talk about POST because usually GET does not change anything on the server, but it's certainly possible to have GETs with side-effects that need CSRF protection. – Mike Ounsworth Mar 25 '20 at 15:54
  • @mti2935 withCredentials worked. Many thanks. I think you should write an answer so I can accept it. – Lokesh Mar 25 '20 at 16:47

In order for cookies to be sent with cross-site requests, .withCredentials must be set to True in the cross-site request. See https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS for more info (scroll down to the section 'Requests with credentials').

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.