Linked Questions

0
votes
1answer
175 views

recreating CSRF Token after usage [duplicate]

Is it a good practice to recreate the CSRF Token once its been used (basically create a new taken after a post request is sent)? Or it an unnecessary measure to take? My current system is recreating ...
67
votes
4answers
77k views

CSRF protection with custom headers (and without validating token)

For a REST-api it seems that it is sufficient to check the presence of a custom header to protect against CSRF attacks, e.g. client sends "X-Requested-By: whatever" and the server checks the ...
17
votes
5answers
14k views

Does setting httponly prevent stealing a session using XSS?

If a session token is stored in a cookie that has httponly set, is there any way that a XSS vulnerability could allow a malicious user to steal a users session token?
21
votes
1answer
28k views

How does a CSRF token prevent an attack, and how can I safely use/avoid it for my JSON API?

I'm trying to make an iOS app communicate with a Ruby on Rails website using JSON. While trying to post a login to create a user session, I discovered I was missing a CSRF token. I had no idea what ...
10
votes
2answers
6k views

Why does Double Submit Cookies require a separate cookie?

According to https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Double_Submit_Cookies: When a user authenticates to a site, the site should generate a (...
6
votes
2answers
2k views

Is one CSRF token per session is adequate with HTTPS?

Ours is a Ajax heavy application with concurrent Ajax requests. Generating unique tokens with each request or expire and creation of new tokens after a certain interval could get tricky with multiple ...
5
votes
3answers
3k views

Advantages of multiple valid CSRF tokens

As far as I understand there are two approaches to perform CSRF protection: 1) CSRF token per session - the token is generated once per session. This is the easiest way; 2) CSRF token per request - ...
4
votes
2answers
3k views

With BREACH attack, is session-based CSRF token still secure?

This is something I haven't been able wrap my head around, if BREACH allow leaking of information, do we have to mask or generate CSRF token in a time-based or per-request fashion to make it more ...
1
vote
2answers
2k views

Should I use one CSRF token per page or per form?

Is it safe to use one CSRF token per form on my page, ex: <form> <input type="hidden" name="token" vale="<?=$data['login_token'];?>" />" </form> <form> <input ...
1
vote
2answers
3k views

Same CSRF token for multi-tab browsing

I have a little problem regarding to my CSRF token function (it changes the token every request). Here is the scenario of my problem: When I opened 2 pages (with same CSRF Token), when I open the ...
2
votes
2answers
1k views

Is it possible to make the back button work if we use one CSRF-token per request?

Do we need to compromise on back button navigation if we use one CSRF-token per request instead of one token per session? (I was successful in using one token per session without any navigation ...
0
votes
4answers
482 views

Custom CSRF protection mechanism without persisting tokens

I have had this functionality (csrf protection) for quite some time now. The thing I never liked about it is that it saved csrf tokens in the session file. While it may not be a real problem I see it ...
5
votes
1answer
563 views

Session renewal how often is necessary?

I am looking at the session management again of a site and currently it renews the client session id on every page refresh. The idea being that if it is stolen directly from the browser there is less ...
1
vote
2answers
411 views

Do you have to reset CSRF token after login?

In a website that have CSRF protection done using a token added as an hidden element in forms, if a session and a token is generated before login to protect against login CSRF, should you reset the ...
1
vote
1answer
57 views

Double Submit Cookie: Can the attacker set the cookie as a separate header?

I’m using an HttpOnly cookie to store authentication token client-side. To mitigate some of the risks of CSRF attacks, I’m employing the Double Submit Cookie pattern. The same token is saved client-...