Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [csrf]

a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

0
votes
1answer
82 views

Is there a way to post directly to the server without going client side?

I was pentesting a web app and while doing a password change, the client checks for the old password but not the server. Also they've a CSRF vulnerability. So would it be possible to post directly to ...
4
votes
2answers
212 views

CSRF token unique per user session - Why?

OWASP recommends that a CSRF token should be unique per user session. What is the attack vector or reasoning behind that? How could an attacker exploit a web application that does not invalidate the ...
0
votes
0answers
21 views

How do I get a CSRF token from Spring, to send up to my application? [migrated]

All the Spring documentation I've seen says how to use CSRF tokens with Thymeleaf or JSP. I have plain html and javascript files, and a java back-end. First, how do I get the CSRF token from Spring ...
0
votes
1answer
47 views

Anti-CSRF scanner still alerts after adding _csrf token to login form

I am working on a Spring MVC project. I applied CSRF Token to login form by enabling and using in Spring security. When I go to the login page, I can see that a CSRF Token generated automatically ...
0
votes
1answer
74 views

Is stealing the HTTP Basic Authenication header possible via CSRF?

Recently I've been trying to find a way to steal HTTP Basic Authentication credentials via CSRF. For example, if a site is using basic authentication is it possible for an attacker to grab the ...
1
vote
2answers
96 views

Do you have to reset CSRF token after login?

In a website that have CSRF protection done using a token added as an hidden element in forms, if a session and a token is generated before login to protect against login CSRF, should you reset the ...
1
vote
1answer
64 views

Exact difference CSRF vs. DNS Rebinding attacks

I am currently studying CSRF and DNS Rebinding attacks and I am wondering what the exact difference is. As far as I understand, DNS rebinding is way to bypass CORS and thus get information from a ...
-2
votes
1answer
53 views

Session key is the same throughout the session, can this behavior be exploited?

This application uses session key instead of CSRF token but this session key is the same throughout the session, it's not changing. It only changes if I logout and then login again to the application. ...
0
votes
2answers
58 views

Can a password change via CSRF lead to account takeover?

If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF ...
2
votes
1answer
66 views

Anti-CSRF mechanism in a form changing password with an old password input is it required?

What is the risk for a form changing password with an old password input that doesn't have CSRF protection? A form without an old password input, I understand the risk but if the old password input ...
2
votes
1answer
81 views

Using same CSRF token after relogin

I am testing a website and observing the following behavior while intercepting and re-sending the request using postman. CSRF token is generated for each request User logs out. Generated CSRF token ...
0
votes
1answer
103 views

Is it possible to bypass this Xss Filter?

Everyone, I was creating this XSS filter for my node plugin and I want to know is it possible to bypass this? function xSSFilter(str) { return str .replace(/&/g, '&') ...
1
vote
1answer
119 views

Can an attacker make POST or PUT request if he knows CSRF token?

I am testing a scenario to find whether an attacker can change the victims email to the attackers by tricking the victims browser to send a POST/PUT request. In this system, the attacker needs to get ...
1
vote
1answer
48 views

Is xhr.withCredentials making POST endpoints vulnerable to CSRF?

From what I've seen, someone can add the following code to a malicious site (lets say: http://sth.malicioussite.com) and be able to perform ajax post requests to a 3rd party site, along with any ...
0
votes
1answer
103 views

Application design to avoid XSS & CSRF attacks

I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
1
vote
1answer
153 views

OpenID Connect: Is storing access token in browser secure?

I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
0
votes
1answer
147 views

CSRF and XSS protection via Header & Cookie-based JWT (tokens)?

I have built a REST API, where users login, with extra permissions in some cases (or restricted to certain areas of the site; or even admin privileges). What I've built: JWT authorization (added to ...
0
votes
1answer
33 views

CSRF protection for an email subscription website - are there any risks of having it turned off?

I have a main website with an email subscription form. And my other websites where I have an email capture form. A user enters their email on those website and via POST he's redirected to the main ...
0
votes
2answers
189 views

CORS Anywhere to bypass CSRF protection

CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers. Can CORS Anywhere able to bypass CSRF protections? Reason to ask ...
3
votes
2answers
263 views

Is this hybrid (cookie, jwt) authentication method for web applications known and practical?

I have been working with web applications for a while, some months ago I found a possible approach to get the security advantages from Browsers while using cookies for authenticating requests, with ...
0
votes
1answer
53 views

How to fix CSRF vulnerability alert on a website with no user authentication, If it is caused by an external Mailchimp signup form embed

A Website with no authentication has an mailchimp signup form embed. Vulnerability tools are reporting CSRF issues on the hosted website. Who can become victim in this case and how to prevent it and ...
1
vote
0answers
144 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
0
votes
0answers
30 views

What's the attack vector for authenticated wildcard CORS origin for a public API?

I have a public API (intended to be used by third-party websites) authentication only via JWT bearer tokens (no cookie authentication). SPAs have to add the Authorization header for every API request....
0
votes
2answers
278 views

When is it okay not to use anti-forgery token in login page?

In this post, there is a paragraph that mentions a scenario where there is no need to validate anti-forgery token in login page: When is it OK to leave off the anti-forgery token? In general, if ...
0
votes
0answers
48 views

What is double submit cookie? And how it is used in the prevention of CSRF attack?

I was looking at the CSRF prevention steps and was not able to understand how the double submit cookie works?
0
votes
1answer
36 views

How can the Cookie-to-header-token CSRF protection technique be thwarted by permissive CORS origin header?

According to https://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-header_token The protection provided by this technique can be thwarted if the target website disables its same-...
0
votes
2answers
185 views

Why not write the CSRF Token into the Session

I am currently developing a web page and came across the OWASP Cheat sheet about double submit cookies. I am now thinking that's a good idea but I didn't get why you are not storing the CSRF token ...
4
votes
1answer
305 views

How to implement CSRF protection with a cross origin request (CORS)

tl;dr the Cookie-to-header-token method can't work due to the CSRF token cookie not being readable by the client in any way. Is sending the token in a header, and having the client save it in a cookie ...
0
votes
0answers
101 views

JSON-CSRF using Flash SWF Doesn't make POST request

I was trying to recreate a POC where an endpoint didn't have CSRF protection and was exposing a form submission. So, I have read these ( before asking here ): Vimeo hackerone Report by avlidienbrunn ...
1
vote
1answer
59 views

Can the attacker view the response from a CSRF attack request? [duplicate]

In CSRF attacks, the attacker crafts a specific request and convinces the victim to visit the page. I have a doubt in one scenario. Suppose if the victim visits the page, and clicks on the button, ...
1
vote
1answer
154 views

How can I securely disable CSRF validation for native clients when browser clients access the same API?

I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients. How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls? ...
1
vote
1answer
102 views

OAuth 2 state token and protect CSRF

We are trying to build a set of REST APIs which will be authenticated by using attached ID token generated by an OAuth provider. I am trying to understand how to use the state token passed in with ...
0
votes
0answers
26 views

How does SupportsCredentials, Access-Control-Allow-Credentials, and CORS Origin=* relate?

I'm investigating CSRF implementations in ASP.NET, MVC, WebAPI the relationship between the headers that are sent: A Javascript client call of XMLHttpRequest.withCredentials A server response of ...
1
vote
1answer
51 views

Can XSS mitigate all anti-CSRF protections?

Say a website has the following form on their sign-up page: <form method="POST" action="https://example.com/login/"> <input type="hidden" name="x-csrf-token" value="[token]"/> <input ...
0
votes
1answer
40 views

Adding a static token to ZAP vulnerability scanner

I am currently trying to get the OWASP ZAP scanners working on a peculiar website. When authenticated on this website, each GET request needs a "token" (most likely a anti-CSRF token) as a parameter. ...
1
vote
0answers
35 views

Where to store encryption based tokens in Encryption based Token Pattern?

Reading OWASP encrypted tokens pattern they describe the flow as follow: After successful authentication, the server generates a unique token comprised of the user's ID, a timestamp value and a ...
1
vote
2answers
93 views

CSRF and defence mechanisms

I was reading some material about the defense mechanisms used to protect against CSRF attacks. I think I've a question about the one based on a secure token. As far as I know, a web application ...
29
votes
1answer
2k views

Is the core idea behind CSRF protection that the hacker doesn't know the token value?

I'm trying to fully understand the concept behind CSRF, and more importantly, how to protect against it. Can I assume, using only CSRF, so no XSS or other techniques, a hacker cannot know the value ...
1
vote
1answer
130 views

How can CSRF POST happen?

I realise this is a newbie question but when it comes to this im clearly that. On a browser, assuming one received a cookie from site A. Then a different site B makes a call to site A through it's ...
0
votes
1answer
292 views

SameSite cookie attribute and Synchronizer Token Pattern

Recently most browser have added support to the SameSite cookie attribute to prevent CSRF attacks: https://www.owasp.org/index.php/SameSite Question if it is supported should we implement ...
0
votes
1answer
96 views

Does having in-browser password managers further the risks of successful CSRF attacks?

When successful CSRF attacks are executed they have the ability to access credentials and other information between the victim and the site. Are the sites username and password that are stored in the ...
0
votes
1answer
202 views

CSRF Token for Anti Automation for multiple requests

Need some inputs for the CSRF token design to prevent anti-automation. 1. When a page loads for an user session, a request is given to the server, which would fetch the CSRF token , returned as part ...
0
votes
1answer
85 views

Heuristics to Identify CSRF from Web Access Log File

I am new here in security. I want to identify suspicious users on web application by analyzing web access log file. For this, I am considering CSRF attack. For this purpose, I am generating some ...
2
votes
2answers
177 views

CSRF methods: img vs iframe vs form/javascript

I have a questions concerning methods for executing CSRF. I did the CSRF Prompt By-pass lesson in WebGoat (Lessons -> Cross-site Scripting -> CSRF Prompt By-pass). The lesson requires you to craft an ...
2
votes
2answers
77 views

What are the common features to identify CSRF attack from Apache log file?

I have tried CSRF attack on web vulnerability application known as DVWA at my localhost and on kali linux OS. I have changed password on this application by using CSRF. It has collected following log ...
1
vote
0answers
276 views

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

In the context of a web application... should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
0
votes
1answer
204 views

Not convinced on the security of a JWT Token + CSRF Token

Lets suppose I have a web application that uses JWT tokens and CSRF Tokens in its authentication scheme. As I understand it, it works like this: When a user logs in, the client sends a login request. ...
1
vote
2answers
158 views

What to do about vulnerability in a SaaS product I buy?

I work for a university, where I am part of the team responsible for integrating a SaaS Learning Management System (eg: Moodle, Canvas) with the rest of the university's systems. Two months ago, I ...
1
vote
0answers
25 views

SOP for an API specifically serving a single SPA [duplicate]

SOP (same origin policy) provides some security for the users against some attacks, but it is not very strict as it still allows you to send GET and POST requests from a different origin that APIs by ...
-1
votes
2answers
171 views

High Level CSRF

I have been doing a bit of dvwa (damn vulnerable web application) and I have a question on CSRF. There is an additional parameter, a csrf token, which is submitted in the get request. All the answers ...