Linked Questions

0 votes
1 answer
248 views

What possible vulnerabilities exist for dual submitted CSRF tokens (cookie and form field)? [duplicate]

In this question (CSRF cookie vs session based tokens), folks recommend against storing the CSRF token in a cookie, saying that storing it in the session server-side is more secure. What vulnerability ...
Christopher Shroba's user avatar
39 votes
5 answers
10k views

Security of an initial redirection from http://example.com to https://example.com

Suppose that http://example.com/<foo> systematically redirects to https://example.com/<foo>. I enter http://example.com in my browser's URL bar, and I see a page load and the URL bar now ...
Gilles 'SO- stop being evil''s user avatar
35 votes
4 answers
31k views

How to protect against login CSRF?

http://seclab.stanford.edu/websec/csrf/csrf.pdf points out that most CSRF protection mechanisms fail to protect login forms. As https://stackoverflow.com/a/15350123/14731 explains: The ...
Gili's user avatar
  • 2,169
30 votes
5 answers
18k views

Protecting against cross-subdomain cookie attacks

I have been reading about cross-subdomain cookie attacks here. A quick overview of how it works (from Wikipedia): A web site www.example.com hands out subdomains to untrusted third parties One such ...
F21's user avatar
  • 511
22 votes
3 answers
3k views

Why should double submit CSRF tokens be cryptographically strong random numbers?

I was just going through the OWASP's Cheat Sheet for CSRF Prevention. Regarding the double submit cookies method, it says: the site should generate a (cryptographically strong) pseudorandom value ...
thefourtheye's user avatar
19 votes
2 answers
8k views

Why is referer checking needed for Django to prevent CSRF

Today I learned that Django's CSRF protection uses refer(r)er header checking in addition to checking a hidden form field against a cookie. It seems to be important, judging from docs and issue below. ...
Mark's user avatar
  • 333
11 votes
2 answers
7k views

Why does Double Submit Cookies require a separate cookie?

According to OWASP: When a user authenticates to a site, the site should generate a (cryptographically strong) pseudorandom value and set it as a cookie on the user's machine separate from the ...
Gili's user avatar
  • 2,169
12 votes
2 answers
14k views

CSRF in microservice architecture

What should be proper way to implement CSRF protection in microservice architecture? Where services are stateless. To put CSRF verification on system entry? e.g. Gateway With this option I can't ...
d-sauer's user avatar
  • 223
9 votes
3 answers
2k views

What happens if my anti-CSRF token is compromised by an XSS attack?

The interesting Stack Overflow question "Do cookies protect tokens against XSS attacks?" was closed as too broad, but as mentioned in a comment on it, there is a tangible question of "What happens if ...
Daniel's user avatar
  • 223
16 votes
1 answer
6k views

REST API authentication with JWT and CSRF protection for SPA

I'm developing an SPA with REST back end and want to have simple token based authentication. The goal for REST backed is to be stateless. I will explain the security model and try to reference all ...
Marko Vodopija's user avatar
10 votes
1 answer
4k views

Authentication with JWT

I am building SPA (React/Redux) and require user authetification. I have found similar discussions, but haven't found answers for questions I outline below. Here are some options I found to implement: ...
Ilya's user avatar
  • 205
1 vote
2 answers
6k views

Implications of the security model of HTTP cookies on HTTPS connections

I have a feature that would require the user being able to provide the URL for a custom script, store the URL in a cookie, and incorporate the script into subsequent responses. This, of course, ...
Joó Ádám's user avatar
2 votes
2 answers
5k views

Should CSRF 'Double Submit Cookie' technique have a different seed value for the cookie versus the HTTP POST?

I'm reading about the OWASP double submit cookies method of protection and there it states that the cookie value between the header and form should match. That seems to be somewhat of a risk, as the ...
makerofthings7's user avatar
2 votes
1 answer
2k views

Am I missing any loopholes with my current session managment?

I'm building a site with Spring, which requires authentication in order for accessing certain pages. The site is actually composed of a client host, which render the views and handle the data binding,...
Nadav96's user avatar
  • 193
1 vote
1 answer
3k views

Provide CSRF token to the front-end, if not present in the request headers

I have a web app in which, when users request a page, a CSRF token is generated and injected into the jsp page in a hidden input field. The same token is then sent to the server for every AJAX call ...
payloc91's user avatar
  • 135

15 30 50 per page