To protect yourself against XSRF, you need to have a separate token on a page.

See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood

As the posting suggests, its best to have those tokens in a hidden field inside your form. But I wonder, if there is any benefit in storing them in an anonymous function instead, so that the value will be added on submit?

While I can see a vulnerability against XSS in the usual approach, there should be no way to submit a valid form in mine. If someone controls the DOM with XSS, the tokens inside hidden fields are easily revealed, unless its an inaccessible javascript variable.


The problem with this implantation is that the CSRF token is not actually stored within an anonymous function. This token would be stored within text that declares an anonymous function. An XSS payload can request this text from the server using an XHR, the CSRF token can be read and another XHR can be used to send an arbitrary forged request.

Related: Sammy worm explanation, which is a good example of how XSS is used to read a CSRF token. Also, XSS is possible without JavaScript. Now keep in mind the following inequality:

HTTP Response Splitting > XSS > CSRF > Clickjacking

The only time that you need to worry about the token being read is if there's a malicious extension or an MITM attack being carried out.

In both cases, it's no longer a CSRF problem. Both attacks have the capability of catching the request on the fly (after your javascript has assembled it with the token) and modifying it. This isn't CSRF, but it's still a potent attack. (Using HTTPS solves some of this, though you have to assume that the client isn't installing malicious extensions)

If there's an XSS vulnerability somewhere then it's quite easy to call onsubmit() before submitting.

So there really isn't any added safety.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.