Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [csrf]

a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

1
vote
1answer
56 views

Exact difference CSRF vs. DNS Rebinding attacks

I am currently studying CSRF and DNS Rebinding attacks and I am wondering what the exact difference is. As far as I understand, DNS rebinding is way to bypass CORS and thus get information from a ...
0
votes
0answers
52 views

JSON(blob?) to POST/GET request

First i want to say that i'm not sure if its called JSON blob, I found API endpoint on private program which i can convert from JSON to normal GET/POST request with parameters however i have found ...
-2
votes
1answer
52 views

Session key is the same throughout the session, can this behavior be exploited?

This application uses session key instead of CSRF token but this session key is the same throughout the session, it's not changing. It only changes if I logout and then login again to the application. ...
-1
votes
1answer
68 views

What is bad control chars?

In a video of Jason Haddix "How To Shot Web" he said that you can bypass CSRF protection by adding bad control chars to CSRF parameter value. what does he mean? This video: https://youtu.be/-...
0
votes
2answers
50 views

Can a password change via CSRF lead to account takeover?

If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF ...
2
votes
1answer
51 views

Anti-CSRF mechanism in a form changing password with an old password input is it required?

What is the risk for a form changing password with an old password input that doesn't have CSRF protection? A form without an old password input, I understand the risk but if the old password input ...
2
votes
1answer
67 views

Using same CSRF token after relogin

I am testing a website and observing the following behavior while intercepting and re-sending the request using postman. CSRF token is generated for each request User logs out. Generated CSRF token ...
0
votes
1answer
77 views

Is it possible to bypass this Xss Filter?

Everyone, I was creating this XSS filter for my node plugin and I want to know is it possible to bypass this? function xSSFilter(str) { return str .replace(/&/g, '&') ...
1
vote
1answer
106 views

Can an attacker make POST or PUT request if he knows CSRF token?

I am testing a scenario to find whether an attacker can change the victims email to the attackers by tricking the victims browser to send a POST/PUT request. In this system, the attacker needs to get ...
1
vote
1answer
43 views

Is xhr.withCredentials making POST endpoints vulnerable to CSRF?

From what I've seen, someone can add the following code to a malicious site (lets say: http://sth.malicioussite.com) and be able to perform ajax post requests to a 3rd party site, along with any ...
0
votes
0answers
63 views

Application design to avoid XSS & CSRF attacks

I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
1
vote
0answers
76 views

OpenID Connect: Is storing access token in browser secure?

I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
0
votes
1answer
100 views

CSRF and XSS protection via Header & Cookie-based JWT (tokens)?

I have built a REST API, where users login, with extra permissions in some cases (or restricted to certain areas of the site; or even admin privileges). What I've built: JWT authorization (added to ...
0
votes
1answer
32 views

CSRF protection for an email subscription website - are there any risks of having it turned off?

I have a main website with an email subscription form. And my other websites where I have an email capture form. A user enters their email on those website and via POST he's redirected to the main ...
0
votes
2answers
103 views

CORS Anywhere to bypass CSRF protection

CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers. Can CORS Anywhere able to bypass CSRF protections? Reason to ask ...
3
votes
2answers
225 views

Is this hybrid (cookie, jwt) authentication method for web applications known and practical?

I have been working with web applications for a while, some months ago I found a possible approach to get the security advantages from Browsers while using cookies for authenticating requests, with ...
0
votes
1answer
51 views

How to fix CSRF vulnerability alert on a website with no user authentication, If it is caused by an external Mailchimp signup form embed

A Website with no authentication has an mailchimp signup form embed. Vulnerability tools are reporting CSRF issues on the hosted website. Who can become victim in this case and how to prevent it and ...
1
vote
0answers
78 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
0
votes
0answers
18 views

What's the attack vector for authenticated wildcard CORS origin for a public API?

I have a public API (intended to be used by third-party websites) authentication only via JWT bearer tokens (no cookie authentication). SPAs have to add the Authorization header for every API request....
0
votes
2answers
160 views

When is it okay not to use anti-forgery token in login page?

In this post, there is a paragraph that mentions a scenario where there is no need to validate anti-forgery token in login page: When is it OK to leave off the anti-forgery token? In general, if ...
0
votes
0answers
45 views

What is double submit cookie? And how it is used in the prevention of CSRF attack?

I was looking at the CSRF prevention steps and was not able to understand how the double submit cookie works?
0
votes
1answer
29 views

How can the Cookie-to-header-token CSRF protection technique be thwarted by permissive CORS origin header?

According to https://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-header_token The protection provided by this technique can be thwarted if the target website disables its same-...
0
votes
2answers
138 views

Why not write the CSRF Token into the Session

I am currently developing a web page and came across the OWASP Cheat sheet about double submit cookies. I am now thinking that's a good idea but I didn't get why you are not storing the CSRF token ...
4
votes
1answer
151 views

How to implement CSRF protection with a cross origin request (CORS)

tl;dr the Cookie-to-header-token method can't work due to the CSRF token cookie not being readable by the client in any way. Is sending the token in a header, and having the client save it in a cookie ...
0
votes
0answers
57 views

JSON-CSRF using Flash SWF Doesn't make POST request

I was trying to recreate a POC where an endpoint didn't have CSRF protection and was exposing a form submission. So, I have read these ( before asking here ): Vimeo hackerone Report by avlidienbrunn ...
1
vote
1answer
53 views

Can the attacker view the response from a CSRF attack request? [duplicate]

In CSRF attacks, the attacker crafts a specific request and convinces the victim to visit the page. I have a doubt in one scenario. Suppose if the victim visits the page, and clicks on the button, ...
1
vote
1answer
78 views

How can I securely disable CSRF validation for native clients when browser clients access the same API?

I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients. How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls? ...
1
vote
1answer
72 views

OAuth 2 state token and protect CSRF

We are trying to build a set of REST APIs which will be authenticated by using attached ID token generated by an OAuth provider. I am trying to understand how to use the state token passed in with ...
0
votes
0answers
25 views

How does SupportsCredentials, Access-Control-Allow-Credentials, and CORS Origin=* relate?

I'm investigating CSRF implementations in ASP.NET, MVC, WebAPI the relationship between the headers that are sent: A Javascript client call of XMLHttpRequest.withCredentials A server response of ...
1
vote
1answer
50 views

Can XSS mitigate all anti-CSRF protections?

Say a website has the following form on their sign-up page: <form method="POST" action="https://example.com/login/"> <input type="hidden" name="x-csrf-token" value="[token]"/> <input ...
0
votes
1answer
35 views

Adding a static token to ZAP vulnerability scanner

I am currently trying to get the OWASP ZAP scanners working on a peculiar website. When authenticated on this website, each GET request needs a "token" (most likely a anti-CSRF token) as a parameter. ...
1
vote
0answers
29 views

Where to store encryption based tokens in Encryption based Token Pattern?

Reading OWASP encrypted tokens pattern they describe the flow as follow: After successful authentication, the server generates a unique token comprised of the user's ID, a timestamp value and a ...
1
vote
2answers
85 views

CSRF and defence mechanisms

I was reading some material about the defense mechanisms used to protect against CSRF attacks. I think I've a question about the one based on a secure token. As far as I know, a web application ...
29
votes
1answer
2k views

Is the core idea behind CSRF protection that the hacker doesn't know the token value?

I'm trying to fully understand the concept behind CSRF, and more importantly, how to protect against it. Can I assume, using only CSRF, so no XSS or other techniques, a hacker cannot know the value ...
1
vote
1answer
97 views

How can CSRF POST happen?

I realise this is a newbie question but when it comes to this im clearly that. On a browser, assuming one received a cookie from site A. Then a different site B makes a call to site A through it's ...
0
votes
1answer
236 views

SameSite cookie attribute and Synchronizer Token Pattern

Recently most browser have added support to the SameSite cookie attribute to prevent CSRF attacks: https://www.owasp.org/index.php/SameSite Question if it is supported should we implement ...
0
votes
1answer
95 views

Does having in-browser password managers further the risks of successful CSRF attacks?

When successful CSRF attacks are executed they have the ability to access credentials and other information between the victim and the site. Are the sites username and password that are stored in the ...
0
votes
1answer
154 views

CSRF Token for Anti Automation for multiple requests

Need some inputs for the CSRF token design to prevent anti-automation. 1. When a page loads for an user session, a request is given to the server, which would fetch the CSRF token , returned as part ...
0
votes
1answer
68 views

Heuristics to Identify CSRF from Web Access Log File

I am new here in security. I want to identify suspicious users on web application by analyzing web access log file. For this, I am considering CSRF attack. For this purpose, I am generating some ...
2
votes
2answers
155 views

CSRF methods: img vs iframe vs form/javascript

I have a questions concerning methods for executing CSRF. I did the CSRF Prompt By-pass lesson in WebGoat (Lessons -> Cross-site Scripting -> CSRF Prompt By-pass). The lesson requires you to craft an ...
2
votes
2answers
66 views

What are the common features to identify CSRF attack from Apache log file?

I have tried CSRF attack on web vulnerability application known as DVWA at my localhost and on kali linux OS. I have changed password on this application by using CSRF. It has collected following log ...
1
vote
0answers
202 views

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

In the context of a web application... should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
0
votes
1answer
172 views

Not convinced on the security of a JWT Token + CSRF Token

Lets suppose I have a web application that uses JWT tokens and CSRF Tokens in its authentication scheme. As I understand it, it works like this: When a user logs in, the client sends a login request. ...
1
vote
2answers
154 views

What to do about vulnerability in a SaaS product I buy?

I work for a university, where I am part of the team responsible for integrating a SaaS Learning Management System (eg: Moodle, Canvas) with the rest of the university's systems. Two months ago, I ...
1
vote
0answers
25 views

SOP for an API specifically serving a single SPA [duplicate]

SOP (same origin policy) provides some security for the users against some attacks, but it is not very strict as it still allows you to send GET and POST requests from a different origin that APIs by ...
-1
votes
2answers
139 views

High Level CSRF

I have been doing a bit of dvwa (damn vulnerable web application) and I have a question on CSRF. There is an additional parameter, a csrf token, which is submitted in the get request. All the answers ...
0
votes
1answer
193 views

How to exploit CSRF using HTML form to save data? [duplicate]

So I found a CSRF vulnerability on a website. The website is sending GET request to get user data and there is no protection. So using HTML I can get the data from the website if the user is logged in,...
1
vote
1answer
72 views

How to prevent two-stage CSRF attacks?

Assume that we are creating a CSRF token and inject it in a form on the page sendmoney.php. What prevents the attacker from sending a request to sendmoney.php to get the CSRF token and then submitting ...
5
votes
1answer
328 views

Can oauth2 “state” parameter be used to avoid using session cookies to identify user

https://tools.ietf.org/html/rfc6749#section-4.1.1 states: 4.1.1. Authorization Request" "state" RECOMMENDED. An opaque value used by the client to maintain state between the ...
1
vote
0answers
63 views

Do I need CSRF Protection? [duplicate]

I have a Rest API that is located at api.example.com. The user logs in at app.example.com and gets a Cookie which contains the authentication related information and handles the session. Every page ...