Questions tagged [csrf]

a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

Filter by
Sorted by
Tagged with
0 votes
1 answer
79 views

Is the .AspNet.Application cookie vulnerable to CSRF attacks?

I have an MVC application that has undergone SAST. The scan detects a potential XSRF/CSRF vulnerability. The application rewrites the .AspNet.ApplicationCookie setting SameSite=Strict: protected void ...
0 votes
0 answers
87 views

Possibility of using content disposition header to bypass CORB?

Consider a response with the following headers: Content-Type: application/json;charset=UTF-8 Content-Disposition: attachment;filename=text.txt where Content-Disposition appears first, I am able to ...
0 votes
0 answers
32 views

Why famouse frameworks like django (And probably Rails) use both synchronizer pattern and Origin/Referer header checks for preventing CSRF attacks?

I see in the source code of Django that they do use both synchronizer token pattern and Origin/Referer header checks. I understand that if you are using the double-submit technique via cookie the ...
0 votes
1 answer
77 views

Are these SameSite vulnerabilities still present today?

According to this ietf doc there are two vulnerabilities to samesite cookies: Attackers can still pop up new windows or trigger top-level navigations in order to create a "same-site" ...
  • 73
0 votes
1 answer
28 views

Do I need to set up super global SESSION for a web form?

I am building a web form in PHP, is just for the user to request information about my services or send comments, so I don‘t need the user to be logged with a username and a password, no databse. I ...
0 votes
2 answers
141 views

Is CSRF token vulnerable if CORS is enabled?

Let's analyze the following scenario: User authenticates with session cookie I have CORS enabled (like Access-Control-Allow-Origin: * - header) I use CSRF Token to prevent CSRF attacks and I include ...
  • 103
0 votes
2 answers
145 views

Storing Anti-CSRF token in cookie with samesite=strict

The (anti) CSRF Token should protect user from executing a action on the website by clicking a link or a form that is created by an attacker. In the application that I want to secure I can't use an ...
  • 1
0 votes
1 answer
97 views

Access CSRF token in fronted site

I am building a website with a separate Javascript frontend and a Django backend. My backend uses CSRF protection. Now the problem is that the CSRF token is being set on the client side as a cookie on ...
0 votes
1 answer
88 views

Validating CSRF state with an OAuth2 POST Callback

I am setting up OAuth2 for Apple, and it requires a POST response to the callback URL if certain scopes (e.g. email address) are included. My intended process for preventing CSRF: Set a cookie with a ...
3 votes
1 answer
139 views

Are CSRF attacks a thing of the past?

If the default value for the samesite directive in the Set-Cookie header is lax, then surely the only way for a CSRF attack to work, is if the website's developer, for some reason, puts a less ...
0 votes
0 answers
31 views

Cookie-based sessions

During an engagement, i have been asked by a client to explain (with the use of one or more examples) whether having an authenticated cookie-session web upload functionality can be dangerous for the ...
0 votes
0 answers
140 views

Security implications of access and refresh tokens (JWT) with refresh token rotation and automatic reuse detection

In an effort to avoid having to deal with CSRF attacks, I'm trying to implement an auth flow that completely avoids using cookies. In most cases this makes one vulnerable to XSS attacks. However, ...
  • 101
0 votes
0 answers
64 views

Rails API Session Security and CSRF

I am doing an api with Rails(api-only). Security is so importand for me. I got 2 question. 1-) I am keeping user's id in session[:authID], is it safe to use like this? 2-) Do i need CSRF protection ...
  • 1
2 votes
2 answers
476 views

Cookie-to-header token CSRF protection - is it necessary to verify cookie value?

I'm testing Angular application which uses Cookie-to-header token CSRF protection. According to Angular documentation https://angular.io/guide/http#security-xsrf-protection: When performing HTTP ...
  • 1,173
0 votes
0 answers
124 views

Mitigating CSRF and XSS with JWT authentication: can someone tell me where my logic is wrong

I'm currently working on a personal project including a RESTful API and also trying to understand how to make it as secure as possible. I have read a bit about JWT, the possible vulnerabilities as ...
1 vote
1 answer
198 views

Browser sends cookie with "SameSite=Strict" attribute on another domain

I am solving PortSwigger's lab: "CSRF where token is tied to non-session cookie". For testing SameSite attribute I created a cookie in my browser with SameSite=Strict for domain https://<...
0 votes
1 answer
51 views

What possible vulnerabilities exist for dual submitted CSRF tokens (cookie and form field)? [duplicate]

In this question (CSRF cookie vs session based tokens), folks recommend against storing the CSRF token in a cookie, saying that storing it in the session server-side is more secure. What vulnerability ...
1 vote
0 answers
35 views

How to prevent XS-Leaks while maintaining usability?

The methods presented in https://xsleaks.dev/ are based on the fact that malicious Javascript can use Cross-origin requests to infer data by means of faulty status codes, time required, mime type etc. ...
9 votes
4 answers
3k views

Is a backend API server vulnerable to CSRF?

We recently ran a Veracode SAST scan on our application and discovered that it has a CSRF. However, I wanted to check whether this is really true or it's just a false positive. Our application is a ...
  • 193
0 votes
1 answer
172 views

JSON Web Token splitting

It's been quite a few years since the last time I did web development and I realized many things have changed: instead of stateful server-side sessions with authentication cookies and CSRF tokens now ...
1 vote
0 answers
160 views

CSRF and XSS Protection with a Static Site and REST API

I'm building an application which will support both browser and application access to REST resources. Applications will POST a username/password JSON body to a login endpoint which will return a ...
  • 6,715
0 votes
1 answer
115 views

Renewing a CSRF token (as reported by the client) upon reauthenticating

Relevant (unanswered) questions I've asked on StackOverflow: https://stackoverflow.com/questions/70703895/securely-renewing-a-session-without-javascript-and-without-breaking-csrf-protect https://...
  • 101
3 votes
0 answers
243 views

Implement state parameter in OAuth2.0 code flow server-side

I have a scenario where I need to implement OAuth 2.0 authorization code flow on the server side - the user authorizes a backend service against Microsoft, the service receives a token, saves it in a ...
1 vote
1 answer
391 views

JWT cookie with CSRF token as a claim inside the JWT

I am trying to figure out if the solution I am suggesting is valid for both XSS & CSRF protection, I would like to store the JWT in an httpOnly & secure cookie and not in local storage, when ...
  • 113
0 votes
0 answers
91 views

When using a cookie to header CSRF protection with JWTs, how to implement refresh tokens?

Scenario I'm working in the oAuth flow for a new app, which is currently laid out like this A React web App A Rails backend FusionAuth as an Authorization server We are using the oAuth2.0 ...
1 vote
1 answer
441 views

How to implement the CSRF token mechanism for restful APIs?

Considering the following facts, using CSRF token for a restful API (which of course is intrisincly session-less) seems inevitable: storing JWT in local storage(any where other than http-only cookie) ...
  • 113
0 votes
2 answers
476 views

CSRF Tokens and Cookies

I have been trying to understand how CSRF tokens work and from my research, it looks like it is common for the server to provide both a CSRF cookie and a token to the end user. The user then returns ...
  • 1
0 votes
1 answer
168 views

Why can't CSRF be used to steal data? Why does it only affect state-changing actions? [duplicate]

I have been searching on the internet for a few days for the answer to a question, which seemingly noone is asking: Why can attackers not use csrf to steal data? I understand that the victim's browser ...
0 votes
1 answer
155 views

What is considered a secure way to store JWT in browser?

I'd like to rewrite a monolithic social website to use JWT for authentication instead of traditional cookie/sessionm, and I'm looking for a secure implementation. I read here that: You might think an ...
  • 1
0 votes
1 answer
404 views

Security risks to returning JWT token in the response body to a GET request?

Are there any security risks to returning a user's JWT in the response body to a GET request? The JWT is only returned for authenticated users. Authentication is managed via a JWT stored as a HttpOnly,...
0 votes
0 answers
62 views

I have a non-Oauth service and am using this approach with Server initiated HttpOnly cookies with stripped JWT

My question is : Is this approach correct given I have a non-Oauth service? My goal is to use the simplest amount of security features while still being as strong as possible. My approach is as ...
  • 101
0 votes
2 answers
819 views

Cookie-to-header token CSRF protection

I have the Angular application where CSRF protection is implemented using Cookie-to-header token. It is default AngularJS mechanism to counter CSRF, which uses cookie XSRF-TOKEN and header X-XSRF-...
  • 1,173
2 votes
1 answer
148 views

Secure against CSRF by accident

I have an interesting application for secure testing. The POST endpoint is accepting only content-type application/json, any other content results in an 500 error. The application lacks a CSRF token ...
0 votes
1 answer
131 views

What exploit possible when GET request are forged as internal? [closed]

Suppose I was able to bypass CSRF check. I was able to forge any GET request and make it look like it was issued by the user himself. Is the web application vulnerable to somehow to 'Client-side' ...
  • 5
0 votes
1 answer
138 views

What should I worry about when attaching a token to a request manually?

I'm developing a platform that has 2 parts: An API written using Laravel, that integrates with the database and provided data in a restful state. Multiple fronts that connect to the API and perform ...
  • 111
0 votes
1 answer
131 views

CSRF in ADFS environment?

Is traditional CSRF PoC (e.g. described here) effective for testing in this environment Specifically if PoC only involved one account - of course, given presence of ADFS SSO...so not counting the ...
0 votes
0 answers
136 views

I have CSRF protection implemented server side, can I safely use `SameSite=None; Secure; HttpOnly`?

We have a web service where GET is always safe and all unsafe POST requests use single-use CSRF tokens. We have some cases where cross-origin domain would need to pass us POST request with data that ...
0 votes
3 answers
326 views

Transmission of CSRF tokens from client to server

I was reading up on the usage of CSRF tokens at https://portswigger.net/web-security/csrf/tokens and one section mentioned it should be transmitted to the client in a hidden field in a HTML form. How ...
  • 177
13 votes
2 answers
3k views

How do I safely host third-party Javascript code in an iframe?

I'm building a website where users, among other things, can add embeds (YouTube, Google Forms, Airtable...) and show those embeds to other people. Embeds are snippets of HTML that can include <...
  • 243
0 votes
1 answer
176 views

Capturing data from a Change Password form

Through ZAP, I was able to capture the following from a Change Password form: GET /rest/user/change-password?current=P@ssword&new=password123 &repeat=password123 HTTP/1.1 Host: localhost:3000 ...
  • 39
0 votes
1 answer
135 views

Is CSRF attack possible with Custom X- Header?

In sum, if I am able to add a custom header to a request, that allows the disabling of CSRF check, will the endpoint be vulnerable to CSRF Attack ? I'm bit lost.A custom header is such X-SKIP-CSRF: ...
  • 5
1 vote
0 answers
384 views

Is a static SameSite cookie enough to protect against CSRF?

Conventional wisdom to prevent CSRF is to use CSRF tokens, but with the new cookie attributes and prefixes, do you even need to generate/save tokens at all? I've had the thought that if I just set a ...
  • 113
4 votes
2 answers
760 views

Do I still need a CSRF token?

When a client makes the first request, I send a session ID cookie generated by the server as a string of 64 random bytes using getrandom(2) or /dev/urandom, stored in the database, with the flags ...
  • 327
2 votes
2 answers
155 views

Is CSRF needed on a page that does not have authentication

I'm making a configuration page for an embedded Linux device. When the user presses a button, the device starts a WiFi access point. The user connects to the AP and visits the web page. This page is ...
0 votes
2 answers
186 views

CSRF attack when form data isn't parsed

How can you do a CRSF attack on express if it only accepts JSON? Sample Node app: const express = require('express'); const app = express(); app.use(express.json()); app.post('/item', (req, res, ...
1 vote
1 answer
678 views

srcdoc attribute of iframes as a source of XSS attacks

I am trying to implement a case where a user provides us some html code which is then stored in our database. We then retrieve the HTML from our database as a string. (We have no control over the user ...
  • 11
17 votes
2 answers
3k views

Why is CSRF protection only applicable to web services with browser clients? [duplicate]

The Spring docs state: Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-...
0 votes
2 answers
260 views

How does Anti-CSRF token get delivered?

I was reading an article describing how CSRF works. The article did a pretty good job but it started to talk about how to protect against CSRF and one of the methods that the article has mentioned is ...
  • 101
1 vote
1 answer
353 views

Can an Intrusion Prevention System (e.g. Snort) prevent CSRF and XSS attacks?

I am currently learning about IPS and was wondering about a query that applies to how IPS works. I have knowledge of CSRF and XSS attacks, however I am unsure if Intrusion Prevention Systems can ...
0 votes
1 answer
190 views

CSRF tokens in file that we can upload a file

I am dealing with a website vulnerable to CSRF. Let's say that the page (upload.php) has the following code if (isset($file_submit)) { //submit_file() } else { show_submission_form() } ...

1
2 3 4 5
14