A client is only submitting forms using XMLHttpRequest with the use of a header (X-Header: [any value would be correct]) to protect against Cross Site Request Forgery attacks.

I know this is not the right way to prevent CSRF vulnerabilities, but how would you exploit this type of CSRF vulnerability?

The requirement is to send an HTTP request with a custom header.

  • What did you already try?
    – Gumbo
    Commented Apr 6, 2015 at 5:27
  • Normal POST request can't be used to modify headers. Writing a similar XHR request won't work because same-origin policy, as making XHR requset on exampl1e.com to exmaple2.com can't be done on modern browsers.
    – CobyT
    Commented Apr 6, 2015 at 9:35
  • It can when complying to CORS.
    – Gumbo
    Commented Apr 6, 2015 at 9:47
  • Need any further info adding to my answer? Commented Sep 24, 2015 at 16:59

1 Answer 1


This is a very similar method to using the X-Requested-With header, just that X-Header is used instead (neither of which are standard headers, although X-Requested-With could be considered a de-facto standard).

This is a valid method of preventing CSRF as only the following headers are allowed cross domain:

  • Accept
  • Accept-Language
  • Content-Language
  • Last-Event-ID
  • Content-Type

any others cause a "pre-flight" request to be issued in CORS supported browsers. Non CORS browsers will ignore other headers.

As long as the CORS configuration isn't allowing the header and domain the attacker is using then this is a valid method.

If CORS was enabled and was allowing the attacker's domain, then other methods of CSRF protection such as the recommended Synchronizer Token Pattern would also fail because the attacker could make a GET request to retreive the token value (assuming the access-control-allow-credentials header is set to true). Note that lack of CORS does not prevent requests from being made by the browser, it only prevents the responses from being read.

So, it appears that you're out of luck for a CSRF exploit, unless another Flash or browser plugin bug/feature will allow you to add the header to the request.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .