Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [csrf]

a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

Filter by
Sorted by
Tagged with
1 vote
1 answer
59 views

Are CSRF attacks a thing of the past?

If the default value for the samesite directive in the Set-Cookie header is lax, then surely the only way for a CSRF attack to work, is if the website's developer, for some reason, puts a less ...
user avatar
0 votes
0 answers
28 views

Cookie-based sessions

During an engagement, i have been asked by a client to explain (with the use of one or more examples) whether having an authenticated cookie-session web upload functionality can be dangerous for the ...
user avatar
0 votes
0 answers
26 views

Security implications of access and refresh tokens (JWT) with refresh token rotation and automatic reuse detection

In an effort to avoid having to deal with CSRF attacks, I'm trying to implement an auth flow that completely avoids using cookies. In most cases this makes one vulnerable to XSS attacks. However, ...
user avatar
  • 101
0 votes
0 answers
25 views

Rails API Session Security and CSRF

I am doing an api with Rails(api-only). Security is so importand for me. I got 2 question. 1-) I am keeping user's id in session[:authID], is it safe to use like this? 2-) Do i need CSRF protection ...
user avatar
  • 1
1 vote
2 answers
65 views

Cookie-to-header token CSRF protection - is it necessary to verify cookie value?

I'm testing Angular application which uses Cookie-to-header token CSRF protection. According to Angular documentation https://angular.io/guide/http#security-xsrf-protection: When performing HTTP ...
user avatar
  • 1,097
0 votes
0 answers
36 views

Mitigating CSRF and XSS with JWT authentication: can someone tell me where my logic is wrong

I'm currently working on a personal project including a RESTful API and also trying to understand how to make it as secure as possible. I have read a bit about JWT, the possible vulnerabilities as ...
user avatar
0 votes
1 answer
63 views

Browser sends cookie with "SameSite=Strict" attribute on another domain

I am solving PortSwigger's lab: "CSRF where token is tied to non-session cookie". For testing SameSite attribute I created a cookie in my browser with SameSite=Strict for domain https://<...
user avatar
0 votes
1 answer
26 views

What possible vulnerabilities exist for dual submitted CSRF tokens (cookie and form field)? [duplicate]

In this question (CSRF cookie vs session based tokens), folks recommend against storing the CSRF token in a cookie, saying that storing it in the session server-side is more secure. What vulnerability ...
user avatar
1 vote
0 answers
33 views

How to prevent XS-Leaks while maintaining usability?

The methods presented in https://xsleaks.dev/ are based on the fact that malicious Javascript can use Cross-origin requests to infer data by means of faulty status codes, time required, mime type etc. ...
user avatar
9 votes
4 answers
3k views

Is a backend API server vulnerable to CSRF?

We recently ran a Veracode SAST scan on our application and discovered that it has a CSRF. However, I wanted to check whether this is really true or it's just a false positive. Our application is a ...
user avatar
  • 193
0 votes
1 answer
103 views

JSON Web Token splitting

It's been quite a few years since the last time I did web development and I realized many things have changed: instead of stateful server-side sessions with authentication cookies and CSRF tokens now ...
user avatar
0 votes
0 answers
104 views

CSRF and XSS Protection with a Static Site and REST API

I'm building an application which will support both browser and application access to REST resources. Applications will POST a username/password JSON body to a login endpoint which will return a ...
user avatar
  • 6,685
0 votes
1 answer
48 views

Renewing a CSRF token (as reported by the client) upon reauthenticating

Relevant (unanswered) questions I've asked on StackOverflow: https://stackoverflow.com/questions/70703895/securely-renewing-a-session-without-javascript-and-without-breaking-csrf-protect https://...
user avatar
  • 101
3 votes
0 answers
130 views

Implement state parameter in OAuth2.0 code flow server-side

I have a scenario where I need to implement OAuth 2.0 authorization code flow on the server side - the user authorizes a backend service against Microsoft, the service receives a token, saves it in a ...
user avatar
1 vote
1 answer
176 views

JWT cookie with CSRF token as a claim inside the JWT

I am trying to figure out if the solution I am suggesting is valid for both XSS & CSRF protection, I would like to store the JWT in an httpOnly & secure cookie and not in local storage, when ...
user avatar
  • 113
0 votes
0 answers
71 views

When using a cookie to header CSRF protection with JWTs, how to implement refresh tokens?

Scenario I'm working in the oAuth flow for a new app, which is currently laid out like this A React web App A Rails backend FusionAuth as an Authorization server We are using the oAuth2.0 ...
user avatar
1 vote
1 answer
173 views

How to implement the CSRF token mechanism for restful APIs?

Considering the following facts, using CSRF token for a restful API (which of course is intrisincly session-less) seems inevitable: storing JWT in local storage(any where other than http-only cookie) ...
user avatar
  • 113
0 votes
2 answers
215 views

CSRF Tokens and Cookies

I have been trying to understand how CSRF tokens work and from my research, it looks like it is common for the server to provide both a CSRF cookie and a token to the end user. The user then returns ...
user avatar
  • 1
0 votes
1 answer
109 views

Why can't CSRF be used to steal data? Why does it only affect state-changing actions? [duplicate]

I have been searching on the internet for a few days for the answer to a question, which seemingly noone is asking: Why can attackers not use csrf to steal data? I understand that the victim's browser ...
user avatar
0 votes
1 answer
115 views

What is considered a secure way to store JWT in browser?

I'd like to rewrite a monolithic social website to use JWT for authentication instead of traditional cookie/sessionm, and I'm looking for a secure implementation. I read here that: You might think an ...
user avatar
  • 1
0 votes
1 answer
194 views

Security risks to returning JWT token in the response body to a GET request?

Are there any security risks to returning a user's JWT in the response body to a GET request? The JWT is only returned for authenticated users. Authentication is managed via a JWT stored as a HttpOnly,...
user avatar
0 votes
0 answers
60 views

I have a non-Oauth service and am using this approach with Server initiated HttpOnly cookies with stripped JWT

My question is : Is this approach correct given I have a non-Oauth service? My goal is to use the simplest amount of security features while still being as strong as possible. My approach is as ...
user avatar
  • 101
0 votes
2 answers
461 views

Cookie-to-header token CSRF protection

I have the Angular application where CSRF protection is implemented using Cookie-to-header token. It is default AngularJS mechanism to counter CSRF, which uses cookie XSRF-TOKEN and header X-XSRF-...
user avatar
  • 1,097
2 votes
1 answer
143 views

Secure against CSRF by accident

I have an interesting application for secure testing. The POST endpoint is accepting only content-type application/json, any other content results in an 500 error. The application lacks a CSRF token ...
user avatar
0 votes
1 answer
129 views

What exploit possible when GET request are forged as internal? [closed]

Suppose I was able to bypass CSRF check. I was able to forge any GET request and make it look like it was issued by the user himself. Is the web application vulnerable to somehow to 'Client-side' ...
user avatar
  • 5
0 votes
1 answer
109 views

What should I worry about when attaching a token to a request manually?

I'm developing a platform that has 2 parts: An API written using Laravel, that integrates with the database and provided data in a restful state. Multiple fronts that connect to the API and perform ...
user avatar
  • 111
0 votes
1 answer
114 views

CSRF in ADFS environment?

Is traditional CSRF PoC (e.g. described here) effective for testing in this environment Specifically if PoC only involved one account - of course, given presence of ADFS SSO...so not counting the ...
user avatar
0 votes
0 answers
108 views

I have CSRF protection implemented server side, can I safely use `SameSite=None; Secure; HttpOnly`?

We have a web service where GET is always safe and all unsafe POST requests use single-use CSRF tokens. We have some cases where cross-origin domain would need to pass us POST request with data that ...
user avatar
0 votes
3 answers
204 views

Transmission of CSRF tokens from client to server

I was reading up on the usage of CSRF tokens at https://portswigger.net/web-security/csrf/tokens and one section mentioned it should be transmitted to the client in a hidden field in a HTML form. How ...
user avatar
  • 177
13 votes
2 answers
3k views

How do I safely host third-party Javascript code in an iframe?

I'm building a website where users, among other things, can add embeds (YouTube, Google Forms, Airtable...) and show those embeds to other people. Embeds are snippets of HTML that can include <...
user avatar
  • 243
0 votes
1 answer
172 views

Capturing data from a Change Password form

Through ZAP, I was able to capture the following from a Change Password form: GET /rest/user/change-password?current=P@ssword&new=password123 &repeat=password123 HTTP/1.1 Host: localhost:3000 ...
user avatar
  • 39
0 votes
1 answer
115 views

Is CSRF attack possible with Custom X- Header?

In sum, if I am able to add a custom header to a request, that allows the disabling of CSRF check, will the endpoint be vulnerable to CSRF Attack ? I'm bit lost.A custom header is such X-SKIP-CSRF: ...
user avatar
  • 5
1 vote
0 answers
274 views

Is a static SameSite cookie enough to protect against CSRF?

Conventional wisdom to prevent CSRF is to use CSRF tokens, but with the new cookie attributes and prefixes, do you even need to generate/save tokens at all? I've had the thought that if I just set a ...
user avatar
  • 113
4 votes
2 answers
511 views

Do I still need a CSRF token?

When a client makes the first request, I send a session ID cookie generated by the server as a string of 64 random bytes using getrandom(2) or /dev/urandom, stored in the database, with the flags ...
user avatar
  • 327
3 votes
2 answers
134 views

Is CSRF needed on a page that does not have authentication

I'm making a configuration page for an embedded Linux device. When the user presses a button, the device starts a WiFi access point. The user connects to the AP and visits the web page. This page is ...
user avatar
0 votes
2 answers
165 views

CSRF attack when form data isn't parsed

How can you do a CRSF attack on express if it only accepts JSON? Sample Node app: const express = require('express'); const app = express(); app.use(express.json()); app.post('/item', (req, res, ...
user avatar
1 vote
1 answer
522 views

srcdoc attribute of iframes as a source of XSS attacks

I am trying to implement a case where a user provides us some html code which is then stored in our database. We then retrieve the HTML from our database as a string. (We have no control over the user ...
user avatar
  • 11
17 votes
2 answers
2k views

Why is CSRF protection only applicable to web services with browser clients? [duplicate]

The Spring docs state: Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-...
user avatar
0 votes
2 answers
195 views

How does Anti-CSRF token get delivered?

I was reading an article describing how CSRF works. The article did a pretty good job but it started to talk about how to protect against CSRF and one of the methods that the article has mentioned is ...
user avatar
  • 101
1 vote
1 answer
323 views

Can an Intrusion Prevention System (e.g. Snort) prevent CSRF and XSS attacks?

I am currently learning about IPS and was wondering about a query that applies to how IPS works. I have knowledge of CSRF and XSS attacks, however I am unsure if Intrusion Prevention Systems can ...
user avatar
0 votes
1 answer
163 views

CSRF tokens in file that we can upload a file

I am dealing with a website vulnerable to CSRF. Let's say that the page (upload.php) has the following code if (isset($file_submit)) { //submit_file() } else { show_submission_form() } ...
user avatar
0 votes
1 answer
178 views

Default behavior cookie flags in 2021

I'm under the understanding that in 2019, Chrome and Firefox both planned to move to SameSite=lax default for all unspecified cookies. In addition, recently, Chrome decided to set defaults based on ...
user avatar
0 votes
0 answers
2k views

CRSF protection in Next.js applications

So, I am trying to add CSRF protection to my Next.js application. I have tried a development branch of the next-csrf library. I have a couple of questions though: The library saves the CSRF token as ...
user avatar
3 votes
1 answer
1k views

CSRF double submit cookie pattern questions

I have some questions about CSRF protection, specifically about the "double submit cookie" pattern. What I have learned so far, is that this pattern has some weaknesses. But we can add some ...
user avatar
  • 31
1 vote
1 answer
348 views

cant a CSRF token be stolen using iframe?

from what I understand a common approach to storing a CSRF token would be: the client retrieves from the server a CSRF token the token is stored in an input element inside the form like this: <...
user avatar
  • 13
1 vote
2 answers
2k views

Is it possible to read and extract HTTP request headers via JavaScript while performing XSS & CSRF? If so, how?

Is it possible to read and extract HTTP request headers via JavaScript? i.e. something like; var req = new XMLHttpRequest(); req.open(‘GET’, document.location, false); req.send(null); var headers = ...
user avatar
4 votes
3 answers
254 views

Custom fixed header + cookies: am I protected against CSRF?

I have REST APIs which are behind a webserver, then there is a custom single page application frontend hosted on it (React). It goes like that: The user logs to the index page, if the session cookie ...
user avatar
  • 151
0 votes
2 answers
238 views

JWT is being sent in cookies, but when I try for CSRF they are not sent

I am testing this application which sends JWT and CSRF token in cookies, I created a PoC file to test for CSRF, but only CSRF token is being sent in the PoC request and not JWT. I was under the ...
user avatar
  • 1
3 votes
1 answer
532 views

Is an XSS via Cross-Site File Upload (CSFU) practically exploitable?

I came across a very interesting case: The user uploads a file The file contains <script>alert(2)</script> The web app shows the file's content to the user -> the XSS payload is ...
user avatar
  • 133
0 votes
0 answers
418 views

JWT refresh tokens and Double Submit Cookies

I am struggling to implement JWT refresh tokens with the Double Submit Cookies method. My current set up for a browser based webapp without refresh tokens looks like this: Upon successful login, API ...
user avatar

1
2 3 4 5
14