0

In general, CSRF protection means this: "compare <input type=hidden> with a value in user's session" (or sometimes - user cookie).

Now, suppose I want my app/website to be iframe compatible (while still protecting from CSRF "session-riding" attacks).

However, newer browser versions will disable setting a cookie inside iframes. Chrome has this in their roadmap for 2021 and they are already enforcing this in incognito tabs (see this answer)

Which means, that every navigation event inside an iframe (clicking a link or POST-ing a form) creates a new Session ID (because the Set-Cookie: MY_FRAMEWORKS_SESSION_ID will be ignored by the browser).

So... What do we do? How do we stay iframe-friendly, while still preventing CSRF?

(apart from "do not use iframes" answer)

1

I don't think that this should be a problem, for at least two reasons

  • you shouldn't need CSRF protection for framable pages. If the page had state-changing functionality which needed to be protected from CSRF, then it also needs to be protected from Clickjacking, so it shouldn't be framable in the first place.
  • you shouldn't need to be able to set new cookies in your iframe for the double-submit cookie prevention mechanism (any cookie that was previously set should still work, and there is no need to regenerate it).

But assuming that for some reason these issues do not apply, you could use one of the other CSRF prevention techniques,eg:

  • custom request header (ajax requests cannot be sent cross origin with custom headers unless allowed by the CORS policy)
  • verify origin header (or referer)
  • using a stateless encrypted token
| improve this answer | |
  • Thanks, upvoted and marked as "accepted", looking at other CSRF techniques. As for the "shouldn't be framable in the first place" part - well, there are use cases where this is untrue. We are developing an embeddable "live-chat" support widget, that runs in an iframe, while still trying to make it secure and immune to session-hijacking. – Alex Sep 17 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.