This question already has an answer here:

I have been reading all over the internet that I should have CSRF token on my page and this will protect it from CSRF.

However, I can imagine a scenario where anti-CSRF is not helpful. Is my understanding wrong somewhere? Scenario is following.

My website (example.com) has a form with anti-CSRF-token field on it. The attacker creates own page (example2.com), on which he places js code that does following in background:

  • submit GET request to 'example.com'
  • scrape anti-CSRF-token out of it (since he can see the structure of the page by using it himself)
  • make a malicious request to 'example.com' including the scraped value of token, so that my server cannot know that request is not valid

Now, if such scenario is possible, it would mean that whole CSRF-token protection useless!

marked as duplicate by Community Aug 12 '15 at 20:39

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


CSRF tokens are unique for each user and stored on either the server or client side. This means an attacker would have to guess the value of your CSRF token to attack you. If the token is generated using a cryptographically secure PRNG, a basic attack like you describe is not possible.

Not the answer you're looking for? Browse other questions tagged or ask your own question.