If I am still logged in using browser X, can a CSRF attack work when I use another (default) browser Y on the same machine? Assume that the web server has a CSRF vulnerability and no hidden token checking will be done on the server.


No. CSRF works by using a session already in place, and sessions can only exist within the same browser. Or put another way, all current/major browsers do not share sessions.

EDIT: As noted in the comment, it is theoretically possible using flash cookies. IMO, flash cookies are evil to begin with though.

| improve this answer | |
  • 4
    While this is generally true, there are theoretical (and possibly practical) possibilities to conduct current attack via LSO, or so-called flash-cookies. Sure, this heavily depends on application specifics and implementation. – anonymous Mar 5 '11 at 19:28
  • 1
    Good point, @ams. I wonder if this also might apply to Silverlight Isolated Storage, the various HTML5 storage options, web-keys/URL capabilities or any of the other persistence methods used by evercookies. – nealmcb Mar 5 '11 at 20:03
  • Good point. I didn't take into account plugins. – Steve Mar 5 '11 at 22:06

Assuming that the existing CSRF vulnerability is based on the presence of a login cookie, then the simple answer is no (in the general case).
Different browsers (e.g. IE/FF/GC/Safari) each manage their own cookies, and logging in on one will have no effect whatsoever on the cookies for another browser.

However, there are other CSRF flaws which are no based on cookies, which may be relevant to other browsers.
For example, Integrated Windows Authentication -based CSRF would be relevant for IE, even if you had logged in on say FF. Or any other non-cookie based authentication/session management, including flash-based sessions, etc.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.