Questions tagged [csrf]
a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.
691
questions
0
votes
1
answer
32
views
Necessity of CSRF Protection with ID Token Authentication in Firebase
I recently came across a statement in the Firebase documentation that suggests "CSRF protection should be taken into account." This guidance appears in the context of using an ID token for ...
- 101
0
votes
1
answer
106
views
Does Firebase App Check provide CSRF protection?
Quoting the OWASP Cheat Sheet on CSRF Prevention:
Using the Synchronizer Token Pattern:
CSRF tokens should be:
Unique per user session.
Secret
Unpredictable (large random value generated by a secure ...
- 53
0
votes
0
answers
59
views
do I need anti-csrf-tokens or double submit cookie pattern?
currently I'm working on a NestJs backend. I have already implemented the auth feature with jwt (access and refresh) stored in cookies. Originally I sent the jwt by the standard Bearer token way in ...
- 101
0
votes
0
answers
48
views
Security frontend side
Hi i´m a frontend developer and next week we will have a security audit i need to be sure that frontend side is secure and dont have vulnerabilities, so my question is, ¿What would you recommend or ...
0
votes
2
answers
88
views
Why do most examples of CSRF use roundabout ways of executing an API call instead of just using pure Javascript?
When I see examples of CSRF attacks, it is almost always explained with someone entering some external API url in an <img> tag, e.g. <img src="bank.com/transfer?amount=10000?recipient=...
- 1
0
votes
2
answers
85
views
Not requiring POST requests... results in a CSRF vulnerability?
I'm setting up a Jenkins server, and ran across a reported vulnerability, SECURITY-3033, also identified as CVE-2023-37954:
Rebuilder Plugin 320.v5a_0933a_e7d61 and earlier does not require POST
...
- 145
0
votes
1
answer
59
views
Is csrf protection required for extremely short lived cookies?
I have an app with token-based authentication (stateless).
for specific endpoint that serves an pdf file, it was ideal for me to authenticate via cookie.
so I creates a cookie with my access token, ...
- 103
0
votes
1
answer
98
views
CSRF on JSON with origin
I'm testing for CSRF vulnerability, and I have a request like this:
Host: www.test.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: ...
1
vote
1
answer
113
views
Do CSRF Tokens need to be tied to user IDs?
I am implementing a web system using Golang and have incorporated gorilla/csrf for CSRF protection. However, I've encountered an issue. When I have tab1 open in my browser, logged in as user1, and ...
- 11
1
vote
1
answer
117
views
What happens first in a request having both CSRF Token and JWT token, authentication or authorization?
This question came across my mind when I sent an ajax request from html to a backend django server and forgot to add a csrf token to the request payload and recieved this error.
403 error means that ...
0
votes
1
answer
1k
views
Secure alternative to csurf npm package
So the csurf middleware used in Node.js applications has been deprecated since Sept 2022 due to security vulnerabilities being discovered by Fortbridge in Aug 2022. However, it it still being ...
- 103
0
votes
1
answer
53
views
Correct implementation of a "User interaction based CSRF defense" approach?
OWASP CSRF Cheat sheet mentions the "User interaction based CSRF defense", which would also entirely mitigate a CSRF attack. I imagine that the reason OWASP considers it as a Defense-in-...
- 103
2
votes
1
answer
409
views
CSRF: Signed Double Submit Cookie & 'Referer' validation vs MITM and vulnerable subdomains
I have been researching various techniques for preventing CSRF attacks, such as SOP, SameSite, Secure, Referer validation, and CSRF Tokens, and their potential bypasses. During my research, I ...
- 129
1
vote
0
answers
87
views
SSO Using API based login (not through UI redirection)
We have 3 different applications which have the same top level domain.
a.example.com
b.example.com
example.com
We have a login mechanism where the user provides a username + password and logs in. ...
- 283
2
votes
2
answers
405
views
When using double submit cookies as protection against csrf, does it matter where the random key is created?
I have a stateless backend and a spa-frontend. Except for the login request, all requests are secured by a jwt in the header.
Additionally the application should now be secured against csrf. Since the ...
- 121
1
vote
1
answer
379
views
Are CORS headers useless?
It is common to say that CORS headers protect against CSRF, so that if you visit a malicious website, it cannot make a request to your web application because the referer header (the URL of the ...
0
votes
1
answer
324
views
Session based CSRF Tokens - What value do i use with JWT?
The Double Submit Cookie CSRF Token pattern is a stateless technique that doesn't require storage or a database. However, it's vulnerable to session hijacking attacks and sub-/sibling domains that are ...
- 129
0
votes
1
answer
863
views
Does CORS Access-Control-Allow-Credentials apply to non-origin/third-party cookies or as well?
I understand if you are cross-communicating with origin A, then if origin A has no Access-Control-Allow-Credentials in the response, you will never be able to reuse Cookies obtained from origin A ...
- 103
0
votes
0
answers
63
views
Is storing access token in private data, refresh token in http-only cookie safe?
Backend: Django / Django Rest Framework, would be hosted at GCP k8s
Frontend: Angular, would be hosted at some CDN e.g Vercel
Authentication: JWT (https://github.com/jazzband/djangorestframework-...
1
vote
1
answer
368
views
How to implement Double Submit Cookie with Encryption or HMAC
I'm trying to implement the Double Submit Cookie pattern with extra protection using encrypted or signed CSRF tokens. I'm working with a Single Page Application and a stateless API. The purpose of ...
- 111
0
votes
1
answer
118
views
How are Fetch Metadata Request Headers more secure than the Referer Header?
https://www.w3.org/TR/fetch-metadata/ for reference.
It seems like this is a simplified version of referer headers. Is the only advantage backend developer usability?
- 494
1
vote
1
answer
373
views
Using CSRF token as state parameter for OAuth request
I recently completed Azure OAuth2 integration with my existing web application. Upon user's successful login into my application user can configure multiple outlook accounts using OAuth2 flow.
As for ...
- 113
1
vote
1
answer
414
views
About pre-session and login CSRF attacks with SPA REST API
We have react SPA application which call a back REST API. According to this paper (section 4.1) it is recommended to make a pre-session and then implement token-based CSRF protencion to stop login ...
- 13
2
votes
1
answer
566
views
Is it possible to steal a cookie without HttpOnly via CSRF?
Without giving too many details away, let's say that I'm auditing an API that:
Has access-control-allow-credentials: true
Has access-control-allow-origin: *
Needs JWT set in Authorization header for ...
- 35
2
votes
2
answers
709
views
Why do we need CSRF controls if session ID is used?
I am confused about this. Behavior and properties of both seem identical: both are generated server-side, should be cryptographically secure, with the lifetime not to exceed session duration. If all ...
- 436
2
votes
1
answer
459
views
Cookie flow in a site that hosts embedded Youtube video
When there's a Youtube video embedded on a site that I visit while I am logged in Youtube beforehand,how does the embedded video know that it's me so I can add it to my Watch Later list?
I think the ...
- 2,493
1
vote
0
answers
82
views
How can I manipulate certain server side responses? Specifically Ajax Responses? XXE Attack? Hybrid DNS Resolution?
I would like to be able to switch back and forth between the real DNS and maybe setting a local DNS entry so I can manipulate AJAX responses for code security checks.
For instance if the server ...
- 141
3
votes
2
answers
309
views
CSRF protection for oauth authorization
I've read a lot about the state parameter in oauth flow. But i cant quite understand if the state validation helps my use case.
end to end flow:
resource owner is redirected to service provider site(...
- 213
1
vote
2
answers
82
views
Should CSRF tokens protect against crafting a CSRF request by someone who has access to the same computer?
My server generates a random CRSF token if it doesn't find one in the cookies and saves it to the cookies encrypted, and supplies the raw token in the body of the response, to be read by an SPA and ...
0
votes
2
answers
206
views
Security vulnerabilities from storing anti CSRF token in global JS variable?
What are the security vulnerabilities arising from storing anti CSRF token as a global JS variable and use it for every requests made which need CSRF protection?
If there are any vulnerabilities what ...
0
votes
1
answer
226
views
Null origin CSRF in HTTP POST, is it possible?
Is it possible to construct an HTTP POST based CSRF attack with a null origin?
- 1
1
vote
2
answers
637
views
Is my understanding of CSRF, SOP and CORS correct (Express / React)?
I am a hobby developer and am developing an application with a Node JS / Express backend and a React frontend.
I am currently learning about Cross Site Request Forgery (CSRF), and I want to make sure ...
- 11
1
vote
1
answer
441
views
Can we set a custom CSRF token inside header requests to make a CSRF PoC?
I'm trying to create a PoC for a CSRF issue I found. The request contains the CSRF token inside the request header and the problem is that the server side is checking only if the token is available ...
- 13
0
votes
1
answer
611
views
Is the .AspNet.Application cookie vulnerable to CSRF attacks?
I have an MVC application that has undergone SAST. The scan detects a potential XSRF/CSRF vulnerability.
The application rewrites the .AspNet.ApplicationCookie setting SameSite=Strict:
protected void ...
2
votes
1
answer
429
views
Are these SameSite vulnerabilities still present today?
According to this ietf doc there are two vulnerabilities to samesite cookies:
Attackers can still pop up new windows or trigger top-level
navigations in order to create a "same-site" ...
- 103
0
votes
1
answer
45
views
Do I need to set up super global SESSION for a web form?
I am building a web form in PHP, is just for the user to request information about my services or send comments, so I don‘t need the user to be logged with a username and a password, no databse. I ...
- 1
0
votes
2
answers
969
views
Is CSRF token vulnerable if CORS is enabled?
Let's analyze the following scenario:
User authenticates with session cookie
I have CORS enabled (like Access-Control-Allow-Origin: * - header)
I use CSRF Token to prevent CSRF attacks and I include ...
- 103
0
votes
2
answers
1k
views
Storing Anti-CSRF token in cookie with samesite=strict
The (anti) CSRF Token should protect user from executing a action on the website by clicking a link or a form that is created by an attacker.
In the application that I want to secure I can't use an ...
- 1
2
votes
2
answers
2k
views
How to access CSRF token in fronted when API is on different domain?
I am building a website with a separate Javascript frontend and a Django backend. My backend uses CSRF protection.
Now the problem is that the CSRF token is being set on the client side as a cookie on ...
- 23
0
votes
1
answer
499
views
Validating CSRF state with an OAuth2 POST Callback
I am setting up OAuth2 for Apple, and it requires a POST response to the callback URL if certain scopes (e.g. email address) are included.
My intended process for preventing CSRF:
Set a cookie with a ...
5
votes
1
answer
445
views
Are CSRF attacks a thing of the past?
If the default value for the samesite directive in the Set-Cookie header is lax, then surely the only way for a CSRF attack to work, is if the website's developer, for some reason, puts a less ...
- 199
0
votes
0
answers
64
views
Cookie-based sessions
During an engagement, i have been asked by a client to explain (with the use of one
or more examples) whether having an authenticated cookie-session web upload
functionality can be dangerous for the ...
2
votes
0
answers
739
views
Security implications of access and refresh tokens (JWT) with refresh token rotation and automatic reuse detection
In an effort to avoid having to deal with CSRF attacks, I'm trying to implement an auth flow that completely avoids using cookies. In most cases this makes one vulnerable to XSS attacks. However, ...
- 121
3
votes
2
answers
3k
views
Cookie-to-header token CSRF protection - is it necessary to verify cookie value?
I'm testing Angular application which uses Cookie-to-header token CSRF protection. According to Angular documentation https://angular.io/guide/http#security-xsrf-protection:
When performing HTTP ...
- 1,293
2
votes
1
answer
2k
views
Browser sends cookie with "SameSite=Strict" attribute on another domain
I am solving PortSwigger's lab: "CSRF where token is tied to non-session cookie". For testing SameSite attribute I created a cookie in my browser with SameSite=Strict for domain https://<...
- 123
0
votes
1
answer
215
views
What possible vulnerabilities exist for dual submitted CSRF tokens (cookie and form field)? [duplicate]
In this question (CSRF cookie vs session based tokens), folks recommend against storing the CSRF token in a cookie, saying that storing it in the session server-side is more secure. What vulnerability ...
1
vote
0
answers
48
views
How to prevent XS-Leaks while maintaining usability?
The methods presented in https://xsleaks.dev/ are based on the fact that malicious Javascript can use Cross-origin requests to infer data by means of faulty status codes, time required, mime type etc. ...
- 53
10
votes
4
answers
3k
views
Is a backend API server vulnerable to CSRF?
We recently ran a Veracode SAST scan on our application and discovered that it has a CSRF. However, I wanted to check whether this is really true or it's just a false positive.
Our application is a ...
- 203
0
votes
1
answer
277
views
JSON Web Token splitting
It's been quite a few years since the last time I did web development and I realized many things have changed: instead of stateful server-side sessions with authentication cookies and CSRF tokens now ...
- 444
1
vote
0
answers
285
views
CSRF and XSS Protection with a Static Site and REST API
I'm building an application which will support both browser and application access to REST resources.
Applications will POST a username/password JSON body to a login endpoint which will return a ...
- 6,753