Questions tagged [csrf]

a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

Filter by
Sorted by
Tagged with
0
votes
0answers
16 views

How to handle Antiforgery on Multiple ASP.Net Core APIs and Angular SPA

I am using an Angular SPA which calls multiple Asp.Net Core APIs. I need to enable Antiforgeryvalidation in all APIs and all requests should be validated. 1.) Products API hosted mydomain.com/api/...
0
votes
2answers
52 views

Blazor WASM Anti-Forgery Token

I am working on securing a Blazor WASM site. So far I have a Auth API so that my multiple apps can use one auth service. I also have a Blazor WASM site. I am tying to mimic the Anti-Forgery Tokens ...
1
vote
1answer
58 views

cant a CSRF token be stolen using iframe?

from what I understand a common approach to storing a CSRF token would be: the client retrieves from the server a CSRF token the token is stored in an input element inside the form like this: <...
1
vote
1answer
87 views

Is it possible to read and extract HTTP request headers via JavaScript while performing XSS & CSRF? If so, how?

Is it possible to read and extract HTTP request headers via JavaScript? i.e. something like; var req = new XMLHttpRequest(); req.open(‘GET’, document.location, false); req.send(null); var headers = ...
4
votes
3answers
180 views

Custom fixed header + cookies: am I protected against CSRF?

I have REST APIs which are behind a webserver, then there is a custom single page application frontend hosted on it (React). It goes like that: The user logs to the index page, if the session cookie ...
0
votes
2answers
50 views

JWT is being sent in cookies, but when I try for CSRF they are not sent

I am testing this application which sends JWT and CSRF token in cookies, I created a PoC file to test for CSRF, but only CSRF token is being sent in the PoC request and not JWT. I was under the ...
2
votes
1answer
65 views

Is an XSS via Cross-Site File Upload (CSFU) practically exploitable?

I came across a very interesting case: The user uploads a file The file contains <script>alert(2)</script> The web app shows the file's content to the user -> the XSS payload is ...
0
votes
0answers
76 views

JWT refresh tokens and Double Submit Cookies

I am struggling to implement JWT refresh tokens with the Double Submit Cookies method. My current set up for a browser based webapp without refresh tokens looks like this: Upon successful login, API ...
1
vote
2answers
52 views

Cookie-to-Header CSRF protection vs CORS

What advantages does a Cookie-to-header technique give over CORS in a cross-origin request scenario? Example scenario: A rest API called api.com provides data to good.com. api.com has allowlisted ...
0
votes
0answers
60 views

JWT implementation and protection against CSRF and XSS

I have been going through OWASP guidelines on managing JWT based authentication. So, I have decided to change my current JWT implementation as per that. Flow is as below. When authenticated ...
2
votes
0answers
38 views

Why is the .NET 5.0 antiforgery byte array length in bits not a common multiple of 6 and 8?

I was learning how antiforgery tokens work behind the scenes and wrote this article on the possible values a token can have. When the byte array is converted to base64, there are four left over bits ...
0
votes
0answers
77 views

Why does using JWT refresh tokens protect against CSRF during authentication?

I have read a few articles regarding JWT refresh tokens, and how/why they are used. One thing i have seen mentioned here: https://hasura.io/blog/best-practices-of-using-jwt-with-graphql/#persistance ...
2
votes
2answers
611 views

Is this test enough to proof that the web application is vulnerable to Login CSRF?

SCENARIO: web application which I think is affected by: a self-xss in the profile section of a user. logout CSRF login CSRF Below I described the test I did to check for the last 2 vulnerabilities, ...
1
vote
2answers
69 views

Does OpenID Connect provide CSRF and XSS protection?

I've been reading several articles recently about how storing JWTs in local or session storage is inherently insecure. The mitigation is apparently to implement a "session ID pattern", i.e. ...
1
vote
1answer
132 views

Is there benefit to an Anti-forgery cookie with sameSite:none?

We have a form that is using asp.net core AntiForgery validation. Recently encountered an issue with a form on the site hosted on www.domain.ie not being able to POST to the API at api.domain.co.uk ...
0
votes
2answers
148 views

How do I protect a Laravel backend API from hijacking/CSRF when there is a React frontend?

I'm finding it really hard to find a solution to make secure requests via our API without a potential hacker being able to see sensitive secret information via Google Chrome dev tools (or any browser'...
2
votes
1answer
52 views

CSRF payload delivery

If an attacker successfully delivers a CSRF payload by any means, what response can he can see once a victim clicks the link?
0
votes
1answer
99 views

CSRF token in SPA login JSON response?

Is it safe to include the CSRF token as part of an HTTPS successful login JSON response in an SPA? If not, is there a better mechanism for sending it which avoids the Double Submit Cookie pattern? ...
1
vote
1answer
59 views

Is server side CORS protection enough to mitigate CSRF attacks against stateless APIs?

Assume an Angular SPA application on www.example.com that works invoking an API over that same domain www.example.com/api/... The Angular app gets a session cookie and sends it in each API call. The ...
1
vote
1answer
71 views

Why using “state” variable in OAuth 2

I am building an application that is integrated with a 3rd party service provider and uses OAuth 2 to obtain permission from other users using the service to access their account information. Based on ...
8
votes
2answers
282 views

Why does Spring Security unset and set the same Cookie in one Request?

In the CSRF implementation of Spring Security (https://github.com/spring-projects/spring-security/blob/master/web/src/main/java/org/springframework/security/web/csrf/CsrfAuthenticationStrategy.java#...
0
votes
0answers
36 views

Double submit with signed CSRF token, is it safe?

In this article about CSRF, it is mentioned that the "double submit" protection can be circumvented by the attacker inventing a token and setting it as a cookie (through XSS I guess). Now ...
0
votes
1answer
184 views

Detailed explanations on OWASP Zap Security scan rules

As an example, I have installed Anti-CSRF Scanning rule in ZAP proxy and scanned a POST request which does not verify the CSRF token value from the back end. Ideally, it is a CSRF vulnerability, but ...
0
votes
0answers
52 views

Are application using custom header instead of CSRF token safe?

This application sends data to the server in JSON and checks for the content-type header, but I was able to bypass this, but it sends another custom header which is not a secret token or something ...
1
vote
0answers
18 views

Do __VIEWSTATEGENERATOR, __EVENTVALIDATION prevent CSRF? [duplicate]

I've seen __VIEWSTATEGENERATOR, __EVENTVALIDATION in every .NET website. Theirs value change, for example, at every login request. Do these fields prevent CSRF? If yes/no, why?
2
votes
1answer
78 views

Should I check Host header or ServerName for CSRF defense when serving behind proxies?

In a CSRF defense based on checking forbidden headers, should I check Origin/Referer header against the ServerName configuration directive, or is it sufficient to simply check against the HTTP Host ...
0
votes
1answer
47 views

Protecting an external authentication server against CSRF

I have a web application which uses an external authentication server for obtaining a session. When a client tries to login, the browser is making requests towards the external authentication server ...
0
votes
0answers
79 views

It's possible to bypass CSRF protection Referer-Based by spoof the referer in browser victim ? (POST-Based)

It's possible to bypass CSRF protection Referer-Based by spoof the referer in browser victim ? (POST-Based) Hello, i try to bypass a CSRF protection Referer-Based. I know the basic knowledge to bypass ...
0
votes
0answers
23 views

Why it is _the client_ (and not _the authorization server_) who is to validate the anti-CSRF state in OAuth workflow?

The client MUST implement CSRF protection for its redirection URI. This is typically accomplished by requiring any request sent to the redirection URI endpoint to include a value that binds the ...
3
votes
0answers
103 views

How can I implement CSRF Tokens without server-side rendering/templating?

I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
0
votes
0answers
25 views

How can the CSRF happen if browsers do not allow cross-origin requests by default? [duplicate]

How can the CSRF happen if browsers do not allow cross-origin requests by default? Brief CSRF overview, which is relevant for the question. CSRF is a type of attack (i.e. cross-site request forgery). ...
0
votes
1answer
183 views

CSRF Security Independent From Front-End

I'm trying to figure out if I completely understand CSRF security properly. Based on: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html In all ...
0
votes
3answers
80 views

Understanding the difference between POST and PUT when securing against CSRF

Several of my Spring Security based projects expose a RESTful API that support the full range of HTTP verbs: GET, POST, PUT, PATCH, DELETE, etc. For those projects only using GET and POST, everything ...
0
votes
1answer
321 views

iframe-friendly CSRF protection

In general, CSRF protection means this: "compare <input type=hidden> with a value in user's session" (or sometimes - user cookie). Now, suppose I want my app/website to be iframe ...
0
votes
1answer
39 views

In what ways site administrators can detect incoming CSRF attacks?

In what ways site administrators can detect incoming CSRF attacks? Is it possible or not?
1
vote
0answers
113 views

What is meaning of setting port number to NULL in document.domain call?

Here (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it is mentioned The port number is checked separately by the browser. Any call to document.domain, including document....
0
votes
0answers
26 views

Doesn't seem to change _csrf token

I recently saw a very interesting post from a person describing all the steps he would take before running a scan (https://groups.google.com/g/zaproxy-users/c/SMd9OmcVWbE). It caught my attention ...
1
vote
1answer
271 views

Exploiting CSRF on DELETE Request

I was testing a site and came across a request with DELETE and I found X-CSRF: parameter was sent to ensure the doc can be deleted by a authorized person but when I removed the entire X-CSRF token and ...
0
votes
1answer
51 views

token _csrf in an url POST

I wanted to know if it was a bad thing to have a _csrf token stored in a url. I saw that in a POST request that allows me to upload a file, the _csrf token was displayed in the url. Is it sensitive to ...
0
votes
2answers
120 views

How is AMP-Same-Origin: true even remotely secure?

in the AMP Docs, the following snippet is given: If the Origin header is set: If the origin does not match one of the following values, stop and return an error response: <publisher's domain>....
2
votes
3answers
97 views

CSRF defense use case

You have an embedded device that supports HTTP based web UI over private ip address. Does it make sense to implement CSRF defense over HTTP(not HTTPS)?
5
votes
1answer
314 views

Split a JWT between payload and signature

Context: I'm looking at storage solutions for JWT tokens on a single page application. Storing the JWT in the local storage is unsafe and prone to XSS attacks. Storing the JWT in a secure / HTTP only ...
0
votes
2answers
70 views

This application is not using CSRF token but they are still able to protect sensitive actions on the site

This application is not using any CSRF token and not even cookies to identify users on their server. All they do is use a authorization header to identify users. Since an attacker doesn't know value ...
0
votes
0answers
138 views

CSRF token not sent when calling the back-end?

My system composes of NuxtJs and AdonisJs application. Adonis handles csrf tokens for us by sending: set-cookie: adonis-session=XXX; Path=/; HttpOnly set-cookie: XSRF-TOKEN=XXX; Max-Age=7200; Path=/; ...
0
votes
0answers
156 views

Authorization Header (Bearer) Vulnerability

I'd like to brainstorm/ ask regarding a possible vulnerability that I encounter recently. So recently, I was able to find an endpoint where generating an Authorization Token is possible for a user and ...
0
votes
2answers
163 views

Are client generated CSRF tokens as secure as server generated ones

I'm currently struggling with the implementation of CSRF in a web application. The application is (more or less) stateless. There is however a session that is kept in a (HttpOnly) cookie. As we use ...
5
votes
1answer
586 views

CSRF on GraphQL endpoint

I am currently doing bug bounty on a company which uses GRAPHQL for their query language and would like to check if CSRF is possible. After playing around with burpsuite I have conclude the following; ...
0
votes
2answers
63 views

What attack vectors does arbitrary JS on a user profile allow?

Consider a site for frontend devs/designers to host their portfolio apps - pages with arbitrary JS, each hosted on a user's separate profile. What attack vectors would that enable against the site? ...
0
votes
0answers
36 views

CSRF in an API that's used by both browser and apps?

I've recently learned about CSRF, I know that CSRF is for browsers, not apps, which makes sense. but I have a few questions. if an API is used by both browser (front-end) and apps (iOS/android), what ...
1
vote
2answers
230 views

Cross-Domain Request is a CSRF Attack? (CORS)

CORS is a HTTP Suite header that “relax” the SOP. One of the CORS misconfigurations is about to reflect without reg exp the “Origin” client header into “ACAO” response header. If it happens with “ACAC:...

1
2 3 4 5
13