Questions tagged [csrf]

a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

Filter by
Sorted by
Tagged with
3
votes
1answer
164 views

Do I still need a CSRF token?

When a client makes the first request, I send a session ID cookie generated by the server as a string of 64 random bytes using getrandom(2) or /dev/urandom, stored in the database, with the flags ...
0
votes
0answers
3 views

Why does the browser show a different CSRF value to my form [migrated]

This is Chrome and the value on the right never changes despite page reload showing a different value on the form each time. Safari does the same thing though with a different (static) value. Question ...
3
votes
2answers
86 views

Is CSRF needed on a page that does not have authentication

I'm making a configuration page for an embedded Linux device. When the user presses a button, the device starts a WiFi access point. The user connects to the AP and visits the web page. This page is ...
0
votes
2answers
91 views

CSRF attack when form data isn't parsed

How can you do a CRSF attack on express if it only accepts JSON? Sample Node app: const express = require('express'); const app = express(); app.use(express.json()); app.post('/item', (req, res, ...
0
votes
1answer
65 views

srcdoc attribute of iframes as a source of XSS attacks

I am trying to implement a case where a user provides us some html code which is then stored in our database. We then retrieve the HTML from our database as a string. (We have no control over the user ...
17
votes
2answers
2k views

Why is CSRF protection only applicable to web services with browser clients? [duplicate]

The Spring docs state: Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-...
0
votes
2answers
61 views

How does Anti-CSRF token get delivered?

I was reading an article describing how CSRF works. The article did a pretty good job but it started to talk about how to protect against CSRF and one of the methods that the article has mentioned is ...
1
vote
1answer
213 views

Can an Intrusion Prevention System (e.g. Snort) prevent CSRF and XSS attacks?

I am currently learning about IPS and was wondering about a query that applies to how IPS works. I have knowledge of CSRF and XSS attacks, however I am unsure if Intrusion Prevention Systems can ...
0
votes
1answer
59 views

CSRF tokens in file that we can upload a file

I am dealing with a website vulnerable to CSRF. Let's say that the page (upload.php) has the following code if (isset($file_submit)) { //submit_file() } else { show_submission_form() } ...
0
votes
1answer
88 views

Default behavior cookie flags in 2021

I'm under the understanding that in 2019, Chrome and Firefox both planned to move to SameSite=lax default for all unspecified cookies. In addition, recently, Chrome decided to set defaults based on ...
0
votes
0answers
335 views

CRSF protection in Next.js applications

So, I am trying to add CSRF protection to my Next.js application. I have tried a development branch of the next-csrf library. I have a couple of questions though: The library saves the CSRF token as ...
3
votes
1answer
290 views

CSRF double submit cookie pattern questions

I have some questions about CSRF protection, specifically about the "double submit cookie" pattern. What I have learned so far, is that this pattern has some weaknesses. But we can add some ...
0
votes
0answers
57 views

How to handle Antiforgery on Multiple ASP.Net Core APIs and Angular SPA

I am using an Angular SPA which calls multiple Asp.Net Core APIs. I need to enable Antiforgeryvalidation in all APIs and all requests should be validated. 1.) Products API hosted mydomain.com/api/...
1
vote
1answer
92 views

cant a CSRF token be stolen using iframe?

from what I understand a common approach to storing a CSRF token would be: the client retrieves from the server a CSRF token the token is stored in an input element inside the form like this: <...
1
vote
1answer
241 views

Is it possible to read and extract HTTP request headers via JavaScript while performing XSS & CSRF? If so, how?

Is it possible to read and extract HTTP request headers via JavaScript? i.e. something like; var req = new XMLHttpRequest(); req.open(‘GET’, document.location, false); req.send(null); var headers = ...
4
votes
3answers
186 views

Custom fixed header + cookies: am I protected against CSRF?

I have REST APIs which are behind a webserver, then there is a custom single page application frontend hosted on it (React). It goes like that: The user logs to the index page, if the session cookie ...
0
votes
2answers
55 views

JWT is being sent in cookies, but when I try for CSRF they are not sent

I am testing this application which sends JWT and CSRF token in cookies, I created a PoC file to test for CSRF, but only CSRF token is being sent in the PoC request and not JWT. I was under the ...
3
votes
1answer
125 views

Is an XSS via Cross-Site File Upload (CSFU) practically exploitable?

I came across a very interesting case: The user uploads a file The file contains <script>alert(2)</script> The web app shows the file's content to the user -> the XSS payload is ...
0
votes
0answers
192 views

JWT refresh tokens and Double Submit Cookies

I am struggling to implement JWT refresh tokens with the Double Submit Cookies method. My current set up for a browser based webapp without refresh tokens looks like this: Upon successful login, API ...
1
vote
2answers
66 views

Cookie-to-Header CSRF protection vs CORS

What advantages does a Cookie-to-header technique give over CORS in a cross-origin request scenario? Example scenario: A rest API called api.com provides data to good.com. api.com has allowlisted ...
0
votes
0answers
66 views

JWT implementation and protection against CSRF and XSS

I have been going through OWASP guidelines on managing JWT based authentication. So, I have decided to change my current JWT implementation as per that. Flow is as below. When authenticated ...
2
votes
0answers
39 views

Why is the .NET 5.0 antiforgery byte array length in bits not a common multiple of 6 and 8?

I was learning how antiforgery tokens work behind the scenes and wrote this article on the possible values a token can have. When the byte array is converted to base64, there are four left over bits ...
0
votes
0answers
134 views

Why does using JWT refresh tokens protect against CSRF during authentication?

I have read a few articles regarding JWT refresh tokens, and how/why they are used. One thing i have seen mentioned here: https://hasura.io/blog/best-practices-of-using-jwt-with-graphql/#persistance ...
2
votes
2answers
629 views

Is this test enough to proof that the web application is vulnerable to Login CSRF?

SCENARIO: web application which I think is affected by: a self-xss in the profile section of a user. logout CSRF login CSRF Below I described the test I did to check for the last 2 vulnerabilities, ...
1
vote
2answers
147 views

Does OpenID Connect provide CSRF and XSS protection?

I've been reading several articles recently about how storing JWTs in local or session storage is inherently insecure. The mitigation is apparently to implement a "session ID pattern", i.e. ...
1
vote
1answer
325 views

Is there benefit to an Anti-forgery cookie with sameSite:none?

We have a form that is using asp.net core AntiForgery validation. Recently encountered an issue with a form on the site hosted on www.domain.ie not being able to POST to the API at api.domain.co.uk ...
0
votes
2answers
205 views

How do I protect a Laravel backend API from hijacking/CSRF when there is a React frontend?

I'm finding it really hard to find a solution to make secure requests via our API without a potential hacker being able to see sensitive secret information via Google Chrome dev tools (or any browser'...
2
votes
1answer
56 views

CSRF payload delivery

If an attacker successfully delivers a CSRF payload by any means, what response can he can see once a victim clicks the link?
0
votes
1answer
139 views

CSRF token in SPA login JSON response?

Is it safe to include the CSRF token as part of an HTTPS successful login JSON response in an SPA? If not, is there a better mechanism for sending it which avoids the Double Submit Cookie pattern? ...
1
vote
1answer
70 views

Is server side CORS protection enough to mitigate CSRF attacks against stateless APIs?

Assume an Angular SPA application on www.example.com that works invoking an API over that same domain www.example.com/api/... The Angular app gets a session cookie and sends it in each API call. The ...
1
vote
1answer
118 views

Why using “state” variable in OAuth 2

I am building an application that is integrated with a 3rd party service provider and uses OAuth 2 to obtain permission from other users using the service to access their account information. Based on ...
8
votes
2answers
471 views

Why does Spring Security unset and set the same Cookie in one Request?

In the CSRF implementation of Spring Security (https://github.com/spring-projects/spring-security/blob/master/web/src/main/java/org/springframework/security/web/csrf/CsrfAuthenticationStrategy.java#...
0
votes
0answers
36 views

Double submit with signed CSRF token, is it safe?

In this article about CSRF, it is mentioned that the "double submit" protection can be circumvented by the attacker inventing a token and setting it as a cookie (through XSS I guess). Now ...
0
votes
1answer
289 views

Detailed explanations on OWASP Zap Security scan rules

As an example, I have installed Anti-CSRF Scanning rule in ZAP proxy and scanned a POST request which does not verify the CSRF token value from the back end. Ideally, it is a CSRF vulnerability, but ...
0
votes
0answers
56 views

Are application using custom header instead of CSRF token safe?

This application sends data to the server in JSON and checks for the content-type header, but I was able to bypass this, but it sends another custom header which is not a secret token or something ...
2
votes
1answer
78 views

Should I check Host header or ServerName for CSRF defense when serving behind proxies?

In a CSRF defense based on checking forbidden headers, should I check Origin/Referer header against the ServerName configuration directive, or is it sufficient to simply check against the HTTP Host ...
0
votes
1answer
54 views

Protecting an external authentication server against CSRF

I have a web application which uses an external authentication server for obtaining a session. When a client tries to login, the browser is making requests towards the external authentication server ...
0
votes
0answers
114 views

It's possible to bypass CSRF protection Referer-Based by spoof the referer in browser victim ? (POST-Based)

It's possible to bypass CSRF protection Referer-Based by spoof the referer in browser victim ? (POST-Based) Hello, i try to bypass a CSRF protection Referer-Based. I know the basic knowledge to bypass ...
0
votes
0answers
23 views

Why it is _the client_ (and not _the authorization server_) who is to validate the anti-CSRF state in OAuth workflow?

The client MUST implement CSRF protection for its redirection URI. This is typically accomplished by requiring any request sent to the redirection URI endpoint to include a value that binds the ...
3
votes
0answers
176 views

How can I implement CSRF Tokens without server-side rendering/templating?

I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
0
votes
0answers
27 views

How can the CSRF happen if browsers do not allow cross-origin requests by default? [duplicate]

How can the CSRF happen if browsers do not allow cross-origin requests by default? Brief CSRF overview, which is relevant for the question. CSRF is a type of attack (i.e. cross-site request forgery). ...
0
votes
1answer
287 views

CSRF Security Independent From Front-End

I'm trying to figure out if I completely understand CSRF security properly. Based on: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html In all ...
0
votes
3answers
102 views

Understanding the difference between POST and PUT when securing against CSRF

Several of my Spring Security based projects expose a RESTful API that support the full range of HTTP verbs: GET, POST, PUT, PATCH, DELETE, etc. For those projects only using GET and POST, everything ...
1
vote
1answer
655 views

iframe-friendly CSRF protection

In general, CSRF protection means this: "compare <input type=hidden> with a value in user's session" (or sometimes - user cookie). Now, suppose I want my app/website to be iframe ...
0
votes
1answer
41 views

In what ways site administrators can detect incoming CSRF attacks?

In what ways site administrators can detect incoming CSRF attacks? Is it possible or not?
1
vote
0answers
125 views

What is meaning of setting port number to NULL in document.domain call?

Here (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it is mentioned The port number is checked separately by the browser. Any call to document.domain, including document....
0
votes
0answers
28 views

Doesn't seem to change _csrf token

I recently saw a very interesting post from a person describing all the steps he would take before running a scan (https://groups.google.com/g/zaproxy-users/c/SMd9OmcVWbE). It caught my attention ...
1
vote
1answer
474 views

Exploiting CSRF on DELETE Request

I was testing a site and came across a request with DELETE and I found X-CSRF: parameter was sent to ensure the doc can be deleted by a authorized person but when I removed the entire X-CSRF token and ...
0
votes
1answer
55 views

token _csrf in an url POST

I wanted to know if it was a bad thing to have a _csrf token stored in a url. I saw that in a POST request that allows me to upload a file, the _csrf token was displayed in the url. Is it sensitive to ...
0
votes
2answers
138 views

How is AMP-Same-Origin: true even remotely secure?

in the AMP Docs, the following snippet is given: If the Origin header is set: If the origin does not match one of the following values, stop and return an error response: <publisher's domain>....

1
2 3 4 5
13