Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [csrf]

a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

28
votes
1answer
2k views

Is the core idea behind CSRF protection that the hacker doesn't know the token value?

I'm trying to fully understand the concept behind CSRF, and more importantly, how to protect against it. Can I assume, using only CSRF, so no XSS or other techniques, a hacker cannot know the value ...
1
vote
1answer
62 views

How can CSRF POST happen?

I realise this is a newbie question but when it comes to this im clearly that. On a browser, assuming one received a cookie from site A. Then a different site B makes a call to site A through it's ...
0
votes
0answers
42 views
+50

SameSite cookie attribute and Synchronizer Token Pattern

Recently most browser have added support to the SameSite cookie attribute to prevent CSRF attacks: https://www.owasp.org/index.php/SameSite Question if it is supported should we implement ...
0
votes
1answer
89 views

Does having in-browser password managers further the risks of successful CSRF attacks?

When successful CSRF attacks are executed they have the ability to access credentials and other information between the victim and the site. Are the sites username and password that are stored in the ...
0
votes
1answer
76 views

CSRF Token for Anti Automation for multiple requests

Need some inputs for the CSRF token design to prevent anti-automation. 1. When a page loads for an user session, a request is given to the server, which would fetch the CSRF token , returned as part ...
0
votes
1answer
55 views

Heuristics to Identify CSRF from Web Access Log File

I am new here in security. I want to identify suspicious users on web application by analyzing web access log file. For this, I am considering CSRF attack. For this purpose, I am generating some ...
2
votes
2answers
86 views

CSRF methods: img vs iframe vs form/javascript

I have a questions concerning methods for executing CSRF. I did the CSRF Prompt By-pass lesson in WebGoat (Lessons -> Cross-site Scripting -> CSRF Prompt By-pass). The lesson requires you to craft an ...
2
votes
2answers
46 views

What are the common features to identify CSRF attack from Apache log file?

I have tried CSRF attack on web vulnerability application known as DVWA at my localhost and on kali linux OS. I have changed password on this application by using CSRF. It has collected following log ...
1
vote
0answers
78 views

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

In the context of a web application... should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
0
votes
1answer
75 views

Not convinced on the security of a JWT Token + CSRF Token

Lets suppose I have a web application that uses JWT tokens and CSRF Tokens in its authentication scheme. As I understand it, it works like this: When a user logs in, the client sends a login request. ...
1
vote
2answers
122 views

What to do about vulnerability in a SaaS product I buy?

I work for a university, where I am part of the team responsible for integrating a SaaS Learning Management System (eg: Moodle, Canvas) with the rest of the university's systems. Two months ago, I ...
1
vote
0answers
20 views

SOP for an API specifically serving a single SPA [duplicate]

SOP (same origin policy) provides some security for the users against some attacks, but it is not very strict as it still allows you to send GET and POST requests from a different origin that APIs by ...
-1
votes
2answers
89 views

High Level CSRF

I have been doing a bit of dvwa (damn vulnerable web application) and I have a question on CSRF. There is an additional parameter, a csrf token, which is submitted in the get request. All the answers ...
0
votes
1answer
78 views

How to exploit CSRF using HTML form to save data? [duplicate]

So I found a CSRF vulnerability on a website. The website is sending GET request to get user data and there is no protection. So using HTML I can get the data from the website if the user is logged in,...
1
vote
1answer
62 views

How to prevent two-stage CSRF attacks?

Assume that we are creating a CSRF token and inject it in a form on the page sendmoney.php. What prevents the attacker from sending a request to sendmoney.php to get the CSRF token and then submitting ...
4
votes
1answer
168 views

Can oauth2 “state” parameter be used to avoid using session cookies to identify user

https://tools.ietf.org/html/rfc6749#section-4.1.1 states: 4.1.1. Authorization Request" "state" RECOMMENDED. An opaque value used by the client to maintain state between the ...
1
vote
0answers
58 views

Do I need CSRF Protection? [duplicate]

I have a Rest API that is located at api.example.com. The user logs in at app.example.com and gets a Cookie which contains the authentication related information and handles the session. Every page ...
1
vote
2answers
131 views

POST Method Anti-CSRF Help With Burp Suite

I am testing a web application and encountering anti-CSRF tokens within forms which is hampering fuzzing attempts using Burp Suite intruder. An anti-CSRF token appears as csrf-token within a HTML meta ...
0
votes
0answers
57 views

Oauth2 vulnerable authentication flow with state parameter

As per my understanding, this is the standard authentication flow to log in a user using auth service provider; But I've seen some framework and examples, where they build authentication URI at ...
1
vote
0answers
34 views

Automatic Paypal payment through API

I am building a game similar to HQ trivia, that when someone gives all the correct answers at the end of the game he or she gets money sent to their Paypal account, my concern is obviously security. ...
1
vote
4answers
137 views

Is it OK to put the CSRF token in a cookie?

I am developing CSRF protection with a token for one of my applications. Since there is no place to implement the token in POST or GET or form data, I am thinking about putting it in a cookie. Is that ...
4
votes
3answers
596 views

Is CSRF still a relevant attack vector?

CSRF was part of older OWASP TOP 10 lists but has been retired "as many frameworks include CSRF defenses, it was found in only 5% of applications". But even without frameworks doing CSRF defense, I've ...
0
votes
2answers
82 views

What are the places one should look for CSRF flaw? [closed]

While finding vulnerabilities in a web app what are the potential areas where one should look for CSRF flaw?
1
vote
2answers
59 views

Why most of the web applications use CRSF token as a prevention method instead validating through origin header?

Why was crsf token discovered at the first place? One can always check from the the request generated by origin header
1
vote
2answers
141 views

Can a site vulnerable to XSS be used to attack a site with a CSRF vulnerability?

I heard of the attacks Cross Site Scripting (XSS: An attack where an attacker injects malious client side code (For example: JavaScript) into a web application.) and Cross Site Request Forgery (CSRF: ...
2
votes
2answers
196 views

XMLHttpRequest CSRF fails with allowed CORS

I'm currently working on a PoC for a CSRF attack, which should be possible due to the lax CORS configuration. I have a permission to attack. Now the following code should send a OPTIONS request, ...
0
votes
1answer
111 views

A different CSRF token and session ID passed in the request [closed]

A CSRF token is what a server includes in its response, that is the same token which is passed in the request from the user. In my case, a different CSRF token is getting included in the request- ...
1
vote
2answers
119 views

Can I put the session token in the body to protect against CSRF? [duplicate]

Say I have a user with an associated session token. This user wants to delete his account, and so he goes to its associated link. I, trying to protect my users and myself from CSRF attacks, have it so ...
1
vote
1answer
43 views

How does Software Defined Perimeter (SDP) protect against certains attack that happen in the browser?

I have been doing a bit of research on SDP (Software Defined Perimeter) but it's still a bit unclear to me how it protects against certain types of attacks. On Wikipedia it says that it can protect ...
1
vote
0answers
45 views

CSRF protection and Single Page Apps on hosted on S3 (with no backend.)

I have a webapp written in js that runs on AWS S3. There is no way to initialize a secure CSRF token on page load since there is no backend server. The token has to be retrieved via an AJAX call to my ...
2
votes
1answer
68 views

CSRF Testing. Validation Error 422. Locale Required

So I'm testing this site for coursework and I think it might be vulnerable CSRF however when I try to make a post request I get a validation error which says "locale" is required despite me specifying ...
2
votes
1answer
284 views

CSRF Protection Is Needed for GET Requests

I have a REST API that allows authenticated users to read data about their own account and make changes to their accounts. For authentication I use JWTs stored as httpOnly cookies. To protect against ...
1
vote
1answer
110 views

Origin Header Vs Token based mitigation

OWASP CSRF Prevention cheatsheet talks about two popular mitigations for CSRF - Origin/Referrer header check and Token based. Are there any issues Origin/referrer check based mitigation that could ...
0
votes
2answers
401 views

CSRF Origin and Referer Header just check host?

Note: This question is not the same as the linked possible duplicate. That question asks how checking the origin/referer header protects against CSRF. This questions is asking how to implement the ...
0
votes
0answers
59 views

Microservices: JWT and Springboot

I'm developing a backend infrastructure based on microservices. I'm using Springboot framework. Regarding the authentication and authorization phases, I would use Oauth2 + JWT. That's mainly because ...
2
votes
1answer
171 views

csrf token placement

I know there are multiple places to put a csrf token and the most common one is to put in a hidden input field in a form. Second is in a cookie with the httpOnly flag. What I want to know is, is there ...
0
votes
1answer
251 views

If CSRF tokens are embedded in meta tags, how do they offer security?

If someone is using my website, and they close a tab, then the CSRF token is now gone on the client side, because it was embedded on the page. If that same person opens the site in a new tab, the page ...
2
votes
0answers
112 views

How does the Ruby on Rails CSRF Protection Work?

I am not sure i completely understand how Ruby on Rails handles CSRF protection. My understanding was that a token is generated and embedded in the HTML markup as a meta tag, and at the same time ...
1
vote
1answer
58 views

What is the “validity scope” of a browser cookie?

Consider the standard CSRF protection of a Ruby on Rails application: a CSRF token is embedded in the HTML page, while at the same time stored encrypted as part of the session cookie. When making a ...
5
votes
1answer
559 views

Do I need CSRF protection in this setup with a REST API backed with oauth2 and a basic auth SSO auth server?

I've seen the answer Is CSRF possible if I don't even use cookies? but there are 2 conflicting answers and the question itself doesn't provide that much information either. I am creating a REST ...
0
votes
2answers
324 views

is every site without a CSRF token vulnerable to CSRF attack?

I found a lot of popular sites not having crsf token in cookie header, does that mean all of these sites are vulnerable? I tried to learn more about it and found there's something called CORS which ...
3
votes
1answer
871 views

Two solutions for CSRF on OWASP for ASP.NET WebForms

I am confused about differences between those two solutions from OWASP ASP.NET Web Froms Guidance Solution one: While viewstate isn't always appropriate for web development, using it can provide ...
9
votes
1answer
686 views

Current status of SameSite cookie

Recently I got to know about SameSite cookie attribute which is used to mitigate the CSRF attacks. AFAIK SameSite attribute for cookies is implemented in Chrome and some other browsers. Since I'm ...
1
vote
1answer
477 views

Why are cross-domain POST requests allowed? [duplicate]

I understand that best practice is to use tokens to prevent CSRF, but why do browsers permit cross-site POST requests in the first place? It seems like giving untrusted parties unfettered write ...
2
votes
1answer
210 views

Obtaining CSRF Token

As I have read about CSRF tokens, the server usually embeds the CSRF token in the form on a hidden tag. In that way, when submitting the form as a POST request, the CSRF token can be sent and received ...
2
votes
1answer
95 views

Why can CSRF attack be prevented by issuing CSRF tokens?

The common way to prevent CSRF requests: Each time the user loads a page that contains a form to be POSTed, the user is issued a CSRF token that it supposed to be unknown to potentially malicious ...
3
votes
3answers
130 views

Why are CSRF vulnerabilities considered to be a problem with the web app, rather than with the browser?

From microsoft docs: CSRF vulnerabilities are fundamentally a problem with the web app, not the end user. And indeed, the typical solution (CSRF tokens) is a server-side solution rather than ...
3
votes
1answer
604 views

Authentication with JWT

I am building SPA (React/Redux) and require user authetification. I have found similar discussions, but haven't found answers for questions I outline below. Here are some options I found to implement: ...
0
votes
1answer
388 views

Is CORS and CSRF-tokens only for POST and GET requests? [closed]

I have the following questions regarding CSRF, SOP and CORS. Does CSRF tokens only protect form submission with either POST or GET methods? Is this just a "common practice" (regarding the fact that ...
4
votes
3answers
244 views

What is the quick fix for CSRF attack?

The application is constructed in Java language and JSF framework. I have reported a CSRF attack and the development team have to fix it soon since the application is in production. I recommended to ...