Linked Questions

65
votes
4answers
77k views

CSRF protection with custom headers (and without validating token)

For a REST-api it seems that it is sufficient to check the presence of a custom header to protect against CSRF attacks, e.g. client sends "X-Requested-By: whatever" and the server checks the ...
19
votes
3answers
5k views

Why is the synchronizer token pattern preferred over the origin header check to prevent CSRF

I am well aware of the concept of CSRF, and I think I am also aware of the possible protection possibilities, as described by OWASP. However, I'm not sure why the synchronizer pattern seems to be ...
11
votes
4answers
3k views

Preventing insecure webapp on subdomain compromise security of main webapp

I want your help on getting more concrete information on a type of vulnerability that I remember vaguely. I vaguely remember hearing about a year ago that if you set up a webapp on a subdomain, and ...
4
votes
4answers
2k views

about CSRF on form submit [duplicate]

I'm surely missing something in the picture of how CSRF attacks and protections are working. My understanding in a form-submit scenery is the protection rely on a unpredictable token, someway is ...
4
votes
1answer
6k views

In which ways could a javascript making a cross domain HEAD request be a threat?

I was just reading this answer to the question Why is the same origin policy so important? Basically, when you try to make an XMLHttpRequest to a different domain, the browser will do one of two ...
3
votes
3answers
559 views

Understanding SOP in multiple tabs

I am reading another answer on this website. It says: Assume you are logged into Facebook and visit a malicious website in another browser tab. Without the same origin policy JavaScript on that ...
10
votes
4answers
362 views

Security implications of download attribute

The download attribute in an a element tells the browser to force the download of a file that otherwise would be interpreted by the browser. This is very convenient, since often users want to download ...
2
votes
1answer
452 views

Why is the same origin policy sensible - for requests?

This is not the same question as Why is the same origin policy so important?. That one asks only about why cookies are only ever send to origin they came from, which I understand. What I don't ...
3
votes
1answer
409 views

Is same origin policy for web only useful because of cookies?

There is a same origin policy in the browser to ensure that e.g. bad site won't read your data from Facebook. But it seems that the only problem that it tries to solve is that cookies are ...
0
votes
2answers
322 views

Same origin policy pentesting?

As we all know that what is the SOP? As its very popular. But my question arises when, pentesting this functionality. AS SOP provide the website to call the resources only from its domain. Ex. http: /...
0
votes
1answer
56 views

Custom JavaScript injection allowed in DOM of other origins [closed]

I am performing a security research on a development framework for thick client & mobile applications. The framework allows developers to inject custom JavaScript in the DOM of any origin. This ...