Initial situation:

A RESTful webservice defends against CSRF attacks by using the double submit cookie approach. This means that the authentication token gets submitted twice and verified at the service side.

Problem / Security Threat:

The WebView element of the android and iOS plattforms allow to create a malicious web browser that unveils and modifies session cookies. webView.loadUrl("javascript:document.cookie=’’;");. If the attacker already figured out, how the double submitted cookie looks like, (In this case it's the AuthenticationToken) he is able to create a malicious RESTBrowser. Therefore he adds the already known CSRFToken to the document object model and thus bypasses the CSRF countermeasure. Is that right so far?

Possible Preventions:

So far I have no idea how I can prevent an attacker from creating und publishing such a malicious mobile application, as well to prevent the service from beeing accessed via malicious mobile applications. I know about the existence of the User-Agent header and that the service can use this information to reject requests from others than specific browsers. But I'm sure that also this header can be manipulated within the WebView.

What are effective countermeasures aginst CSRF in contex of malicious mobile applications?

2 Answers 2


It's an app. It can send your server any cookies it wants. It can save the password as the user types it. It's in complete control. You have no more "defense" against this than you do against Mozilla Firefox or Google Chrome.


If the underlying application is malicious, there is not really much that can be done to prevent against anything, let alone CSRF, especially when the page is being loaded inside a webview of the malicious app. As j__m mentioned, it is indeed in complete control of the webview & can choose to do whatever it wishes with it.

I recently wrote a blogpost explaining this exact exploit scenario in (too much) details. You may want to check it out.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .