Let's analyze the following scenario:

  • User authenticates with session cookie
  • I have CORS enabled (like Access-Control-Allow-Origin: * - header)
  • I use CSRF Token to prevent CSRF attacks and I include it in HTML document's body

Is it possible to perform CSRF attack like this?: (Attack from domain: attack.com)

  1. In atack.dom/index.html is written script that executes GET mydomain.com via e.g. window.fetch.
  2. This script extracts CSRF Token from fetched mydomain.com/index.html
  3. It performs then the real CSRF attack as it already has valid CSRF Token so it does attach this token to <form> and submit this prepared <form>

Is it possible? Is enabling CORS possibly making my wesbite vulnerable to CSRF attack despite the fact I'm using CSRF Token protection?

New contributor
Qback is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.


Your Answer

Qback is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.