1

For users using modern browsers, is it safe to assume they won't be able to be hijacked via CSRF and the likes? If not, how likely is it that an attack can take place?

1 Answer 1

1

No, there is no protection offered against CSRF by any browser by default. This is because the browser does not know the difference between a legitimate cross site request and an attack.

How likely - this depends if

  1. A CSRF vulnerability exists in any of the sites you visit that you remain logged into.
  2. A CSRF exploit for one of those sites is active on any other site you may visit.

You can protect yourself if you only log into one site at once, and clear your cookies between each (it might be better to restart your browser to make sure session cookies are cleared too, although Chrome can run in the background too so you'd need to make sure it is fully closed, and additionally Chrome can resume sessions between restarts so experiment to make sure your settings are correct to prevent this).

Also you should make sure other objects are cleared such as HTML5 local storage, and Flash and Silverlight storage. It might be easier to open a new incognito or private browsing window for each site you visit, making sure to close all tabs and windows before you visit the next site.

Both approaches will make sure that any CSRF attacks attempted while you browse the web will fail because you will not be authenticated on the target site. The only possible CSRF attack you may have to worry about is if you use any sites that use your IP address as the only means of authentication, or if you have set your browser to automatically provide a client-side certificate. Incognito mode should protect your from the latter though.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .