Questions tagged [csrf]

a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

Filter by
Sorted by
Tagged with
0
votes
0answers
28 views

Protecting an external authentication server against CSRF

I have a web application which uses an external authentication server for obtaining a session. When a client tries to login, the browser is making requests towards the external authentication server ...
0
votes
0answers
36 views

It's possible to bypass CSRF protection Referer-Based by spoof the referer in browser victim ? (POST-Based)

It's possible to bypass CSRF protection Referer-Based by spoof the referer in browser victim ? (POST-Based) Hello, i try to bypass a CSRF protection Referer-Based. I know the basic knowledge to bypass ...
0
votes
0answers
21 views

Why it is _the client_ (and not _the authorization server_) who is to validate the anti-CSRF state in OAuth workflow?

The client MUST implement CSRF protection for its redirection URI. This is typically accomplished by requiring any request sent to the redirection URI endpoint to include a value that binds the ...
1
vote
0answers
38 views

How can I implement CSRF Tokens without server-side rendering/templating?

I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
0
votes
0answers
22 views

How can the CSRF happen if browsers do not allow cross-origin requests by default? [duplicate]

How can the CSRF happen if browsers do not allow cross-origin requests by default? Brief CSRF overview, which is relevant for the question. CSRF is a type of attack (i.e. cross-site request forgery). ...
0
votes
1answer
49 views

CSRF Security Independent From Front-End

I'm trying to figure out if I completely understand CSRF security properly. Based on: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html In all ...
0
votes
1answer
49 views

Understanding the difference between POST and PUT when securing against CSRF

Several of my Spring Security based projects expose a RESTful API that support the full range of HTTP verbs: GET, POST, PUT, PATCH, DELETE, etc. For those projects only using GET and POST, everything ...
0
votes
1answer
55 views

iframe-friendly CSRF protection

In general, CSRF protection means this: "compare <input type=hidden> with a value in user's session" (or sometimes - user cookie). Now, suppose I want my app/website to be iframe ...
0
votes
1answer
33 views

In what ways site administrators can detect incoming CSRF attacks?

In what ways site administrators can detect incoming CSRF attacks? Is it possible or not?
1
vote
0answers
99 views

What is meaning of setting port number to NULL in document.domain call?

Here (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it is mentioned The port number is checked separately by the browser. Any call to document.domain, including document....
0
votes
0answers
23 views

Doesn't seem to change _csrf token

I recently saw a very interesting post from a person describing all the steps he would take before running a scan (https://groups.google.com/g/zaproxy-users/c/SMd9OmcVWbE). It caught my attention ...
1
vote
1answer
81 views

Exploiting CSRF on DELETE Request

I was testing a site and came across a request with DELETE and I found X-CSRF: parameter was sent to ensure the doc can be deleted by a authorized person but when I removed the entire X-CSRF token and ...
0
votes
1answer
42 views

token _csrf in an url POST

I wanted to know if it was a bad thing to have a _csrf token stored in a url. I saw that in a POST request that allows me to upload a file, the _csrf token was displayed in the url. Is it sensitive to ...
0
votes
1answer
81 views

How is AMP-Same-Origin: true even remotely secure?

in the AMP Docs, the following snippet is given: If the Origin header is set: If the origin does not match one of the following values, stop and return an error response: <publisher's domain>....
2
votes
3answers
91 views

CSRF defense use case

You have an embedded device that supports HTTP based web UI over private ip address. Does it make sense to implement CSRF defense over HTTP(not HTTPS)?
4
votes
1answer
129 views

Split a JWT between payload and signature

Context: I'm looking at storage solutions for JWT tokens on a single page application. Storing the JWT in the local storage is unsafe and prone to XSS attacks. Storing the JWT in a secure / HTTP only ...
0
votes
2answers
66 views

This application is not using CSRF token but they are still able to protect sensitive actions on the site

This application is not using any CSRF token and not even cookies to identify users on their server. All they do is use a authorization header to identify users. Since an attacker doesn't know value ...
0
votes
0answers
76 views

CSRF token not sent when calling the back-end?

My system composes of NuxtJs and AdonisJs application. Adonis handles csrf tokens for us by sending: set-cookie: adonis-session=XXX; Path=/; HttpOnly set-cookie: XSRF-TOKEN=XXX; Max-Age=7200; Path=/; ...
0
votes
0answers
50 views

Authorization Header (Bearer) Vulnerability

I'd like to brainstorm/ ask regarding a possible vulnerability that I encounter recently. So recently, I was able to find an endpoint where generating an Authorization Token is possible for a user and ...
0
votes
0answers
49 views

Are client generated CSRF tokens as secure as server generated ones

I'm currently struggling with the implementation of CSRF in a web application. The application is (more or less) stateless. There is however a session that is kept in a (HttpOnly) cookie. As we use ...
4
votes
1answer
140 views

CSRF on GraphQL endpoint

I am currently doing bug bounty on a company which uses GRAPHQL for their query language and would like to check if CSRF is possible. After playing around with burpsuite I have conclude the following; ...
0
votes
2answers
63 views

What attack vectors does arbitrary JS on a user profile allow?

Consider a site for frontend devs/designers to host their portfolio apps - pages with arbitrary JS, each hosted on a user's separate profile. What attack vectors would that enable against the site? ...
0
votes
0answers
32 views

CSRF in an API that's used by both browser and apps?

I've recently learned about CSRF, I know that CSRF is for browsers, not apps, which makes sense. but I have a few questions. if an API is used by both browser (front-end) and apps (iOS/android), what ...
1
vote
2answers
103 views

Cross-Domain Request is a CSRF Attack? (CORS)

CORS is a HTTP Suite header that “relax” the SOP. One of the CORS misconfigurations is about to reflect without reg exp the “Origin” client header into “ACAO” response header. If it happens with “ACAC:...
3
votes
0answers
86 views

Should you terminate a session when an incorrect CSRF token is submitted?

According to the OWASP CSRF Prevention Guide if the server fails to ...verify the existence and validity of the token in the request compared to the token found in the user session ... then the ...
5
votes
4answers
284 views

Do I still need CSRF protection when SameSite is set to Lax?

During a security assessment I noticed that Firefox automatically set the SameSite value of a session cookie to Lax. According to the Mozilla specs, this is the case for 'modern browsers'. The ...
0
votes
1answer
27 views

Can you set a custom x-forwarded-host header in a CSRF form page?

Can you set a custom x-forwarded-host header in a CSRF form page (not xhr)?
2
votes
1answer
31 views

CSRF: GET request with POST data?

I have stumbled upon a vulnerability in a web application and was wondering if it was exploitable / worth reporting. The bug is a CSRF which would allow an attacker to send friend requests to himself ...
0
votes
1answer
91 views

CSRF Bypass using User-Agent

This is an unconventional approach of CSRF that I came across while doing the pentest for an Android mobile application. The original request is as follows (NB: Values have been edited): POST /edit/ ...
0
votes
0answers
148 views

XSS Bruteforcing results in 500 internal server error

I've been trying to trigger xss in a website with the following url https://website.com/login/error?username_or_email=xyz%40gmai.com&redirect_after_login=%2wall While trying different payloads ...
0
votes
2answers
138 views

How to prevent CSRF attacks on a REST API when using Windows Authentication

I have a Angular web app that interacts with a REST-API. Requests are authenticated with a JWT Bearer token. I now want to add support for Windows-Authentication. My current plan is to add a POST-...
0
votes
2answers
58 views

How to “trust” data that is posted from one application to other

We have a use case where a bunch of data needs to be posted from our application to a partner site where the end user takes some actions and then returns back to our site. On the return, the partner ...
0
votes
0answers
22 views

Regenerating CSFR token in AJAX requests

I would like to create a new token for each request and would like to us the following template- <script> var current_token=<?php echo $_SESSION['csrf_token']; ?> $....
2
votes
0answers
54 views

What's the point of salting Double Submit Cookie (CSRF protection)?

Django web framework uses the Double Submit Cookie pattern for CSRF protection. (The CSRF token is sent in a cookie and also in a hidden form field. Incoming requests are checked for a match between ...
0
votes
0answers
38 views

What is the correct way to implement the OAuth2 state parameter?

I'm trying to understand how to properly implement state in an OAuth2 client, to mitigate CSRF attacks. This answer explains the attack scenario pretty well, to summarize: The attacker starts the ...
1
vote
2answers
85 views

Is CSRF prevention logic required for api that is consumed only by mobile app?

I am developing an ASP.NET Core web api project whose only client will be a mobile app developed in Xamarin. There will be no web frontend for the application. Can CSRF attacks be executed if the ...
0
votes
1answer
52 views

Prevent Cross-site WebSocket hijacking with a custom header and no CORS

Considering I am vulnerable to Cross-site WebSocket hijacking, so my WebSocket handshake (GET to example.com/wss) does not require a random (CSRF) token. I have defined no CORS settings, so no custom ...
-1
votes
2answers
47 views

Is CSRF possible if i know the value of the authorization bearer token?

If i know the value of bearer token of the victim, can i generate a get csrf page and set a custom Autorization: Bearer [token] header?
-1
votes
2answers
87 views

What is the real purpose of csrf tokens?

When we are dealing with form pages, the recommendation is to use tokens to prevent csrf attacks. I see many csrf tokens set as a hidden HTML field or in the user cookies/headers. I thought that csrf ...
0
votes
0answers
112 views

A mesh of Cookie in Header & HttpOnly token - secure “enough”?

This is another attempt of mine to make sense of securing my web-app, which is built with two frameworks: Django REST API - serves as the backend. It generates both a token upon correct login, and a ...
0
votes
1answer
55 views

Check the origin header server-wide in IIS to prevent CSRF through the IIS configuration change Only

Could you please let me know how can we check the origin header server-wide in IIS to prevent CSRF through the configuration change only without adding a custom HTTP module in IIS?
0
votes
1answer
130 views

How to bypass origin based csrf protection?

I'm trying to do some csrf attack test on a site. I found that the site protect itself from csrf by checking the http Origin header. But I guess maybe under some conditions I can bypass the ...
3
votes
1answer
93 views

Retrieving CSRF token from third party website form using XHR (JavaScript)

I know they say CSRF tokens are the most secure way to prevent CSRF attacks but what if someone uses XHR to retrieve the page containing the csrf token along with the form and then use that token for ...
4
votes
1answer
258 views

Is it safe to create a session from an auth token?

My server is using Django Rest Framework. My mobile app logs in using token authentication. However, I also have a webview in the mobile app where I need to log in. I can't inject the auth token on ...
1
vote
1answer
80 views

Do browsers send cookie on Cross Site GET request?

I am able to make cross site requests because I have enabled CORS. I read about CSRF vulnerability which is caused by the fact that browser sends cookie when making a form POST request. I tried to ...
0
votes
0answers
62 views

How to secure API used by third-parties?

What I am building is service that can be consumed by third-party. Something like Omdb API for example. For my service to be functional I needed to disable CSRF on some endpoints. How can I secure ...
1
vote
3answers
71 views

What is the best defense for a multi-layered attack: Spoofing, MiTM, Login CSRF?

How would one go about defending against this sort of attack to best protect a sloppy user? There can be obvious signs of a spoofing attack, such as not using SSL, slightly different domain, etc, but ...
3
votes
1answer
103 views

Is CSRF protection required for sensitive GET requests with CORS enabled?

Based on other questions, it seems protecting GET resources with CSRF tokens is useless. However, that quickly becomes untrue when CORS gets thrown into the mix I have a server domain server.com and ...
3
votes
1answer
1k views

Generate CSRF token in SPA

I'm extremely confused on the topic of generating a session long CSRF token on a single page application using React. It looks like the convention is to have the server generate the CSRF token on log ...
0
votes
1answer
85 views

Is CSRF possible in a Client Application?

So i was testing a desktop application for first time and identified a possible endpoint vulnerable to csrf, but the problem i'm facing is that when i try to test it in a browser the request doesn't ...

1
2 3 4 5
12