Is traditional CSRF PoC (e.g. described here) effective for testing in this environment
Specifically if PoC only involved one account - of course, given presence of ADFS SSO...so not counting the final 3 steps described above.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
If the user is already authenticated via ADFS they already have the security token and are already "logged in".
Therefore they will still be vulnerable to CSRF on any website.
I have to admit though, it depends heavily on how exactly the ADFS is configured and its relationship to the website at hand. So there is not enough information here to give a clear answer.