Linked Questions

1
vote
0answers
175 views

Is it necessary to add CSRF tokens for REST API? [duplicate]

I have a few REST APIs for an iPhone app. It has a login and session management functionality. Currently the session has been tracked by a token set during login. Are REST services affected by CSRF ...
1
vote
0answers
88 views

CSRF attack - Set custom CSRF Header [duplicate]

The title is a little bit unclear but I had no idea to describe the following issue in there. I found a vulnerability in a website where I am able to bypass the CSRF protection (Bug Bounty program...)...
89
votes
8answers
73k views

Why refresh CSRF token per form request?

In many tutorials and guides I see that a CSRF token should be refreshed per request. My question is why do I have to do this? Isn't a single CSRF token per session much easier than generating one per ...
135
votes
4answers
70k views

Why is the same origin policy so important?

I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
111
votes
4answers
48k views

Should I use CSRF protection on Rest API endpoints?

Quick note: this is not a duplicate of CSRF protection with custom headers (and without validating token) despite some overlap. That post discusses how to perform CSRF protection on Rest endpoints ...
27
votes
2answers
30k views

CSRF with JSON POST

I am playing around with a test application which accepts JSON requests and response is also JSON. I am trying to do a CSRF for a transaction which accepts only JSON data with POST method in request. ...
19
votes
3answers
5k views

Why is the synchronizer token pattern preferred over the origin header check to prevent CSRF

I am well aware of the concept of CSRF, and I think I am also aware of the possible protection possibilities, as described by OWASP. However, I'm not sure why the synchronizer pattern seems to be ...
15
votes
1answer
5k views

How are Ajax requests vulnerable to CSRF attacks if the Same-origin policy is applied?

What I know about CSRF is that a malicious website tricks a normal user into issuing a request to a trusted website using a form. I understand that is possible because we can post forms to different ...
5
votes
2answers
6k views

Will “Authorization: Bearer” in request header fix CSRF attacks? [duplicate]

I have been reading on fixing CSRF attacks. From some research I understand that checking for a non-standard header would prevent CSRF attacks since the browser will not automatically send such ...
2
votes
2answers
6k views

CSRF protection on server side?

I am aware that it is best to keep my web application patched and protected against those kind of attacks, but in my case this is more experimental thing. Is there anything useful, like module that ...
2
votes
1answer
3k views

CSRF-protection using authentication token in HTTP header? [duplicate]

I'm working on a web application which stores an authentication token in a cookie. The only CSRF-protection is referrer checking. I am considering improving this by moving the authentication token ...
2
votes
2answers
1k views

JSON through <script src=, how do you get the JS object in the rogue page?

I was explaining the attack on a JSON REST API the other day (in real life, at work, not here), and I figured out that I do not understand part of the attack vector. Sorry if this is quite a basic ...
0
votes
1answer
382 views

Does custom header for CSRF protection invalidate CSRF protection

A penetration testing is ordered on one of the web sites. I have implemented OWASP CSRF Guard on the web site. It uses custom headers for CSRF protection for AJAX. This got flagged with subject ...
2
votes
2answers
264 views

Is checking a token without checking a header sufficient for CSRF protection?

In their guidelines for securing your application against CSRF attacks, OWASP recommends two separate checks: 1. Check standard headers to verify the request is same origin 2. AND Check CSRF token ...
1
vote
1answer
283 views

How can I securely disable CSRF validation for native clients when browser clients access the same API?

I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients. How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls? ...

15 30 50 per page