from what I understand a common approach to storing a CSRF token would be:

  1. the client retrieves from the server a CSRF token
  2. the token is stored in an input element inside the form like this:
<input type="hidden" name="token" value="abc123supersecrettoken"> 

my question is, would an attack like this be possible, and if so, how can a site be protected:

  1. user logins into facebook.com
  2. user goes to evil.com, the site has he following iframe:
<iframe src="https://www.facebook.com/changeUserPasswordForm"></iframe>
  1. with some basic DOM manipulation on the iframe, the CSRF token could be accessed by the attacker

would an attack like this be possible

This would not be possible. The Same Origin Policy prevents cross-origin reading. This applies also to an iframe from a different domain which is embedded in the current page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.