from what I understand a common approach to storing a CSRF token would be:

  1. the client retrieves from the server a CSRF token
  2. the token is stored in an input element inside the form like this:
<input type="hidden" name="token" value="abc123supersecrettoken"> 

my question is, would an attack like this be possible, and if so, how can a site be protected:

  1. user logins into facebook.com
  2. user goes to evil.com, the site has he following iframe:
<iframe src="https://www.facebook.com/changeUserPasswordForm"></iframe>
  1. with some basic DOM manipulation on the iframe, the CSRF token could be accessed by the attacker

1 Answer 1


would an attack like this be possible

This would not be possible. The Same Origin Policy prevents cross-origin reading. This applies also to an iframe from a different domain which is embedded in the current page.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .