3

If I am still logged in using browser X, can a CSRF attack work when I use another (default) browser Y on the same machine? Assume that the web server has a CSRF vulnerability and no hidden token checking will be done on the server.

2 Answers 2

6

No. CSRF works by using a session already in place, and sessions can only exist within the same browser. Or put another way, all current/major browsers do not share sessions.

EDIT: As noted in the comment, it is theoretically possible using flash cookies. IMO, flash cookies are evil to begin with though.

3
  • 4
    While this is generally true, there are theoretical (and possibly practical) possibilities to conduct current attack via LSO, or so-called flash-cookies. Sure, this heavily depends on application specifics and implementation.
    – anonymous
    Commented Mar 5, 2011 at 19:28
  • 1
    Good point, @ams. I wonder if this also might apply to Silverlight Isolated Storage, the various HTML5 storage options, web-keys/URL capabilities or any of the other persistence methods used by evercookies.
    – nealmcb
    Commented Mar 5, 2011 at 20:03
  • Good point. I didn't take into account plugins.
    – Steve
    Commented Mar 5, 2011 at 22:06
2

Assuming that the existing CSRF vulnerability is based on the presence of a login cookie, then the simple answer is no (in the general case).
Different browsers (e.g. IE/FF/GC/Safari) each manage their own cookies, and logging in on one will have no effect whatsoever on the cookies for another browser.

However, there are other CSRF flaws which are no based on cookies, which may be relevant to other browsers.
For example, Integrated Windows Authentication -based CSRF would be relevant for IE, even if you had logged in on say FF. Or any other non-cookie based authentication/session management, including flash-based sessions, etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .