3

According to the OWASP CSRF Prevention Guide if the server fails to

...verify the existence and validity of the token in the request compared to the token found in the user session ... then the request should be aborted, session of the user terminated and the event logged as a potential CSRF attack in progress.

However, as I understand it terminating the user's session would lead to another vulnerability - an attacker could deliberately submit an incorrect CSRF token with the aim of failing, causing the user to logout (Logout CSRF vulnerability).

Hence, my question; Should the user's session be terminated upon submitting an incorrect CSRF token or not?

  • How would an attacker inject a token into an existing session? – schroeder Jul 9 at 12:42
  • @schroeder For example, if the token is passed in a hidden HTML tag to a endpoint, an attacker could trick a user to submitting a form to the correct endpoint without a CSRF token. Since the browser will automatically send any associated cookies, the user will attempt to perform this action, and assuming they are authenticated, the CSRF protection will then automatically terminate their session out due to them failing the CSRF token check if the sever is set to terminate session upon failure. – Quebec Jul 9 at 12:53
  • 2
    I actually noticed that on OWASP, I was puzzled, and even thought of asking a question like you did (but I didn't). IMO that suggestion doesn't make sense, it's wrong. It could be meant to prevent a second successful CSRF request, which would then fail because the user would have been logged out. But IMO it's not worth it, plus like you said it would introduce additional problems. – reed Jul 9 at 18:08
  • 1
    In a properly set up web application, the cookies would have SameSite flags, and hence CSRF should only be possible on edge-cases (browsers that don't support the flag). In such a case it would be legitimate to terminate the user session when an attempted CSRF-attack is detected. – Martin Fürholz Jul 10 at 23:51
  • 1
    Logout CSRF is merely a negligible nuisance, with almost no security impact on it's own, as long as you can't pair it with some other vulnerability/attack. And a CSRF attack (including logout CSRF) can only work on those browsers which don't implement the SameSite flag correctly. Taken that your application utilizes the SameSite flag. – Martin Fürholz Jul 11 at 10:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.