Linked Questions

38
votes
5answers
8k views

Security of an initial redirection from http://example.com to https://example.com

Suppose that http://example.com/<foo> systematically redirects to https://example.com/<foo>. I enter http://example.com in my browser's URL bar, and I see a page load and the URL bar now ...
30
votes
4answers
23k views

How to protect against login CSRF?

http://seclab.stanford.edu/websec/csrf/csrf.pdf points out that most CSRF protection mechanisms fail to protect login forms. As https://stackoverflow.com/a/15350123/14731 explains: The ...
23
votes
5answers
9k views

Protecting against cross-subdomain cookie attacks

I have been reading about cross-subdomain cookie attacks here. A quick overview of how it works (from Wikipedia): A web site www.example.com hands out subdomains to untrusted third parties One such ...
21
votes
3answers
2k views

Why should double submit CSRF tokens be cryptographically strong random numbers?

I was just going through the OWASP's Cheat Sheet for CSRF Prevention. Regarding the double submit cookies method, it says: the site should generate a (cryptographically strong) pseudorandom value ...
10
votes
2answers
6k views

Why does Double Submit Cookies require a separate cookie?

According to https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Double_Submit_Cookies: When a user authenticates to a site, the site should generate a (...
11
votes
2answers
5k views

Why is referer checking needed for Django to prevent CSRF

Today I learned that Django's CSRF protection uses refer(r)er header checking in addition to checking a hidden form field against a cookie. It seems to be important, judging from docs and issue below. ...
6
votes
2answers
4k views

CSRF in microservice architecture

What should be proper way to implement CSRF protection in microservice architecture? Where services are stateless. To put CSRF verification on system entry? e.g. Gateway With this option I can't ...
7
votes
2answers
798 views

What happens if my anti-CSRF token is compromised by an XSS attack?

The interesting Stack Overflow question "Do cookies protect tokens against XSS attacks?" was closed as too broad, but as mentioned in a comment on it, there is a tangible question of "What happens if ...
1
vote
2answers
6k views

Implications of the security model of HTTP cookies on HTTPS connections

I have a feature that would require the user being able to provide the URL for a custom script, store the URL in a cookie, and incorporate the script into subsequent responses. This, of course, ...
1
vote
2answers
4k views

Should CSRF 'Double Submit Cookie' technique have a different seed value for the cookie versus the HTTP POST?

I'm reading about the OWASP double submit cookies method of protection and there it states that the cookie value between the header and form should match. That seems to be somewhat of a risk, as the ...
10
votes
1answer
2k views

REST API authentication with JWT and CSRF protection for SPA

I'm developing an SPA with REST back end and want to have simple token based authentication. The goal for REST backed is to be stateless. I will explain the security model and try to reference all ...
4
votes
1answer
2k views

Authentication with JWT

I am building SPA (React/Redux) and require user authetification. I have found similar discussions, but haven't found answers for questions I outline below. Here are some options I found to implement: ...
1
vote
2answers
979 views

CSRF by manipulating HTTP headers from client side using JavaScript

I am trying to do CSRF vulnerability analysis for my website. My website uses an anti-CSRF-token which is sent by the server to the client with the session cookie and then Javascript in the client ...
1
vote
1answer
971 views

Provide CSRF token to the front-end, if not present in the request headers

I have a web app in which, when users request a page, a CSRF token is generated and injected into the jsp page in a hidden input field. The same token is then sent to the server for every AJAX call ...
1
vote
1answer
645 views

Am I missing any loopholes with my current session managment?

I'm building a site with Spring, which requires authentication in order for accessing certain pages. The site is actually composed of a client host, which render the views and handle the data binding,...

15 30 50 per page