Linked Questions

0 votes
1 answer

recreating CSRF Token after usage [duplicate]

Is it a good practice to recreate the CSRF Token once its been used (basically create a new taken after a post request is sent)? Or it an unnecessary measure to take? My current system is recreating ...
Gasim's user avatar
  • 103
88 votes
5 answers

CSRF protection with custom headers (and without validating token)

For a REST-api it seems that it is sufficient to check the presence of a custom header to protect against CSRF attacks, e.g. client sends "X-Requested-By: whatever" and the server checks the ...
Mads Mobæk's user avatar
20 votes
5 answers

Does setting httponly prevent stealing a session using XSS?

If a session token is stored in a cookie that has httponly set, is there any way that a XSS vulnerability could allow a malicious user to steal a users session token?
Abe Miessler's user avatar
  • 8,195
22 votes
1 answer

How does a CSRF token prevent an attack, and how can I safely use/avoid it for my JSON API?

I'm trying to make an iOS app communicate with a Ruby on Rails website using JSON. While trying to post a login to create a user session, I discovered I was missing a CSRF token. I had no idea what ...
Dan2552's user avatar
  • 323
11 votes
2 answers

Why does Double Submit Cookies require a separate cookie?

According to OWASP: When a user authenticates to a site, the site should generate a (cryptographically strong) pseudorandom value and set it as a cookie on the user's machine separate from the ...
Gili's user avatar
  • 2,169
8 votes
2 answers

Is one CSRF token per session is adequate with HTTPS?

Ours is a Ajax heavy application with concurrent Ajax requests. Generating unique tokens with each request or expire and creation of new tokens after a certain interval could get tricky with multiple ...
johnbabu koppolu's user avatar
9 votes
4 answers

With BREACH attack, is session-based CSRF token still secure?

This is something I haven't been able wrap my head around, if BREACH allow leaking of information, do we have to mask or generate CSRF token in a time-based or per-request fashion to make it more ...
bitinn's user avatar
  • 213
5 votes
3 answers

Advantages of multiple valid CSRF tokens

As far as I understand there are two approaches to perform CSRF protection: 1) CSRF token per session - the token is generated once per session. This is the easiest way; 2) CSRF token per request - ...
Oleg's user avatar
  • 309
2 votes
2 answers

Should I use one CSRF token per page or per form?

Is it safe to use one CSRF token per form on my page, ex: <form> <input type="hidden" name="token" vale="<?=$data['login_token'];?>" />" </form> <form> <input ...
MisterQuacker's user avatar
1 vote
2 answers

Same CSRF token for multi-tab browsing

I have a little problem regarding to my CSRF token function (it changes the token every request). Here is the scenario of my problem: When I opened 2 pages (with same CSRF Token), when I open the ...
googol8080's user avatar
5 votes
1 answer

Session renewal how often is necessary?

I am looking at the session management again of a site and currently it renews the client session id on every page refresh. The idea being that if it is stolen directly from the browser there is less ...
Kline's user avatar
  • 51
3 votes
2 answers

Is it possible to make the back button work if we use one CSRF-token per request?

Do we need to compromise on back button navigation if we use one CSRF-token per request instead of one token per session? (I was successful in using one token per session without any navigation ...
Girish's user avatar
  • 53
1 vote
2 answers

Do you have to reset CSRF token after login?

In a website that have CSRF protection done using a token added as an hidden element in forms, if a session and a token is generated before login to protect against login CSRF, should you reset the ...
Galdo's user avatar
  • 113
0 votes
4 answers

Custom CSRF protection mechanism without persisting tokens

I have had this functionality (csrf protection) for quite some time now. The thing I never liked about it is that it saved csrf tokens in the session file. While it may not be a real problem I see it ...
php_nub_qq's user avatar
1 vote
1 answer

Double Submit Cookie: Can the attacker set the cookie as a separate header?

I’m using an HttpOnly cookie to store authentication token client-side. To mitigate some of the risks of CSRF attacks, I’m employing the Double Submit Cookie pattern. The same token is saved client-...
zerohedge's user avatar
  • 135