Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [csrf]

a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

Filter by
Sorted by
Tagged with
0 votes
1 answer
35 views

CSRF using Client Side redirect

I have seen in an article regarding CSRF bypass when cookie set with Samesite: Strict. Normally if a cookie is set with Samesite: Strict then it will not be send in a cross origin request. But if the ...
Allen Johnson's user avatar
0 votes
0 answers
198 views

Lax SameSite and POST (2 minute)

I was going through this link https://medium.com/@renwa/bypass-samesite-cookies-default-to-lax-and-get-csrf-343ba09b9f2b to understand CSRF using samesite. Does that mean that the LAX+POST issue has ...
Johnny's user avatar
  • 183
0 votes
1 answer
68 views

javascript app preventing csrf

I am trying to implement measures against csrf in my client spa. I have the following question, since it is difficult for me to use the Signed Double-Submit Cookie. It is possible to implement a csrf ...
juan juanito's user avatar
0 votes
1 answer
118 views

Double Submit Cookie Bypass

I am trying to work on an example for my class on how double submit cookie works and how attackers can bypass it The idea i have is I have two domain att.com and victim.com. The login functionality on ...
Johnny's user avatar
  • 183
0 votes
1 answer
134 views

No csrf token, instead sessiontokens?

Will a random-generated-session-key be enough, so that I can end the usage of csrf token? The front end, will receive the token when logged in. It will be stored in «local storage» at the client’s ...
OrangeSquare's user avatar
4 votes
2 answers
1k views

HTTPonly token without CSRF is safe?

How can a hacker steal my session where my form does not have CSRF tokens but my session cookies are HTTPonly? how would he get my session cookie in this case? is this possible? for example, to be ...
H01F's user avatar
  • 43
1 vote
1 answer
106 views

Why wouldn't a site's cookies be sent in this scenario?

I'm reading an article on Okta's engineering blog, which contains the following paragraph: Some of the disadvantages of cookies include: Cross-site request forgery attacks (XSRF or CSRF): CSRF ...
Richie Thomas's user avatar
3 votes
1 answer
450 views

OIDC with JWT in HTTP-only cookie instead of HTTP Authorization bearer header

I'm exploring the possibility of implementing OpenID Connect (OIDC) with an HTTP-only cookie to keep my frontend code completely authentication-agnostic, instead of passing the Authorization header ...
Luke 10X's user avatar
  • 131
0 votes
1 answer
168 views

Necessity of CSRF Protection with ID Token Authentication in Firebase

I recently came across a statement in the Firebase documentation that suggests "CSRF protection should be taken into account." This guidance appears in the context of using an ID token for ...
Nobuhito Kurose's user avatar
0 votes
1 answer
195 views

Does Firebase App Check provide CSRF protection?

Quoting the OWASP Cheat Sheet on CSRF Prevention: Using the Synchronizer Token Pattern: CSRF tokens should be: Unique per user session. Secret Unpredictable (large random value generated by a secure ...
Joel Burget's user avatar
0 votes
0 answers
168 views

do I need anti-csrf-tokens or double submit cookie pattern?

currently I'm working on a NestJs backend. I have already implemented the auth feature with jwt (access and refresh) stored in cookies. Originally I sent the jwt by the standard Bearer token way in ...
derstauner's user avatar
0 votes
0 answers
87 views

Security frontend side

Hi i´m a frontend developer and next week we will have a security audit i need to be sure that frontend side is secure and dont have vulnerabilities, so my question is, ¿What would you recommend or ...
David Medina's user avatar
0 votes
2 answers
162 views

Why do most examples of CSRF use roundabout ways of executing an API call instead of just using pure Javascript?

When I see examples of CSRF attacks, it is almost always explained with someone entering some external API url in an <img> tag, e.g. <img src="bank.com/transfer?amount=10000?recipient=...
colioli's user avatar
0 votes
2 answers
143 views

Not requiring POST requests... results in a CSRF vulnerability?

I'm setting up a Jenkins server, and ran across a reported vulnerability, SECURITY-3033, also identified as CVE-2023-37954: Rebuilder Plugin 320.v5a_0933a_e7d61 and earlier does not require POST ...
OpenAI was the last straw's user avatar
0 votes
1 answer
99 views

Is csrf protection required for extremely short lived cookies?

I have an app with token-based authentication (stateless). for specific endpoint that serves an pdf file, it was ideal for me to authenticate via cookie. so I creates a cookie with my access token, ...
ינון רחמים's user avatar
0 votes
1 answer
214 views

CSRF on JSON with origin

I'm testing for CSRF vulnerability, and I have a request like this: Host: www.test.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/115.0 Accept: ...
dimas aprilian's user avatar
1 vote
1 answer
304 views

Do CSRF Tokens need to be tied to user IDs?

I am implementing a web system using Golang and have incorporated gorilla/csrf for CSRF protection. However, I've encountered an issue. When I have tab1 open in my browser, logged in as user1, and ...
Kholin's user avatar
  • 11
1 vote
1 answer
298 views

What happens first in a request having both CSRF Token and JWT token, authentication or authorization?

This question came across my mind when I sent an ajax request from html to a backend django server and forgot to add a csrf token to the request payload and recieved this error. 403 error means that ...
Aryaman Gupta's user avatar
1 vote
1 answer
3k views

Secure alternative to csurf npm package

So the csurf middleware used in Node.js applications has been deprecated since Sept 2022 due to security vulnerabilities being discovered by Fortbridge in Aug 2022. However, it it still being ...
jQueeny's user avatar
  • 113
4 votes
1 answer
1k views

Why is the browser not sending cookies with cross-domain WebSocket handshake request?

If I have understood Cross-Site WebSocket Hijacking (CSWSH) attack correctly [1][2][3][4], the attack relies on two things (examples are from the first reference): the browser sending the cookies set ...
sherlock's user avatar
  • 569
0 votes
1 answer
104 views

Correct implementation of a "User interaction based CSRF defense" approach?

OWASP CSRF Cheat sheet mentions the "User interaction based CSRF defense", which would also entirely mitigate a CSRF attack. I imagine that the reason OWASP considers it as a Defense-in-...
Ben Jost's user avatar
  • 103
2 votes
1 answer
977 views

CSRF: Signed Double Submit Cookie & 'Referer' validation vs MITM and vulnerable subdomains

I have been researching various techniques for preventing CSRF attacks, such as SOP, SameSite, Secure, Referer validation, and CSRF Tokens, and their potential bypasses. During my research, I ...
Advena's user avatar
  • 129
1 vote
0 answers
149 views

SSO Using API based login (not through UI redirection)

We have 3 different applications which have the same top level domain. a.example.com b.example.com example.com We have a login mechanism where the user provides a username + password and logs in. ...
gaurav5430's user avatar
2 votes
2 answers
700 views

When using double submit cookies as protection against csrf, does it matter where the random key is created?

I have a stateless backend and a spa-frontend. Except for the login request, all requests are secured by a jwt in the header. Additionally the application should now be secured against csrf. Since the ...
samjaf's user avatar
  • 121
1 vote
1 answer
528 views

Are CORS headers useless?

It is common to say that CORS headers protect against CSRF, so that if you visit a malicious website, it cannot make a request to your web application because the referer header (the URL of the ...
Vitor Figueredo Marques's user avatar
0 votes
1 answer
449 views

Session based CSRF Tokens - What value do i use with JWT?

The Double Submit Cookie CSRF Token pattern is a stateless technique that doesn't require storage or a database. However, it's vulnerable to session hijacking attacks and sub-/sibling domains that are ...
Advena's user avatar
  • 129
0 votes
1 answer
2k views

Does CORS Access-Control-Allow-Credentials apply to non-origin/third-party cookies or as well?

I understand if you are cross-communicating with origin A, then if origin A has no Access-Control-Allow-Credentials in the response, you will never be able to reuse Cookies obtained from origin A ...
Whimusical's user avatar
2 votes
2 answers
651 views

How to implement Double Submit Cookie with Encryption or HMAC

I'm trying to implement the Double Submit Cookie pattern with extra protection using encrypted or signed CSRF tokens. I'm working with a Single Page Application and a stateless API. The purpose of ...
AFP_555's user avatar
  • 121
0 votes
1 answer
176 views

How are Fetch Metadata Request Headers more secure than the Referer Header?

https://www.w3.org/TR/fetch-metadata/ for reference. It seems like this is a simplified version of referer headers. Is the only advantage backend developer usability?
Prime's user avatar
  • 514
2 votes
1 answer
922 views

Using CSRF token as state parameter for OAuth request

I recently completed Azure OAuth2 integration with my existing web application. Upon user's successful login into my application user can configure multiple outlook accounts using OAuth2 flow. As for ...
Amogh's user avatar
  • 123
1 vote
1 answer
646 views

About pre-session and login CSRF attacks with SPA REST API

We have react SPA application which call a back REST API. According to this paper (section 4.1) it is recommended to make a pre-session and then implement token-based CSRF protencion to stop login ...
J.Horcasitas's user avatar
2 votes
1 answer
1k views

Is it possible to steal a cookie without HttpOnly via CSRF?

Without giving too many details away, let's say that I'm auditing an API that: Has access-control-allow-credentials: true Has access-control-allow-origin: * Needs JWT set in Authorization header for ...
JulianGR's user avatar
2 votes
2 answers
2k views

Why do we need CSRF controls if session ID is used?

I am confused about this. Behavior and properties of both seem identical: both are generated server-side, should be cryptographically secure, with the lifetime not to exceed session duration. If all ...
postoronnim's user avatar
2 votes
1 answer
689 views

Cookie flow in a site that hosts embedded Youtube video

When there's a Youtube video embedded on a site that I visit while I am logged in Youtube beforehand,how does the embedded video know that it's me so I can add it to my Watch Later list? I think the ...
microwth's user avatar
  • 2,473
1 vote
0 answers
153 views

How can I manipulate certain server side responses? Specifically Ajax Responses? XXE Attack? Hybrid DNS Resolution?

I would like to be able to switch back and forth between the real DNS and maybe setting a local DNS entry so I can manipulate AJAX responses for code security checks. For instance if the server ...
Neo's user avatar
  • 141
3 votes
2 answers
552 views

CSRF protection for oauth authorization

I've read a lot about the state parameter in oauth flow. But i cant quite understand if the state validation helps my use case. end to end flow: resource owner is redirected to service provider site(...
ProgramCpp's user avatar
1 vote
2 answers
126 views

Should CSRF tokens protect against crafting a CSRF request by someone who has access to the same computer?

My server generates a random CRSF token if it doesn't find one in the cookies and saves it to the cookies encrypted, and supplies the raw token in the body of the response, to be read by an SPA and ...
RationalFragile's user avatar
0 votes
2 answers
325 views

Security vulnerabilities from storing anti CSRF token in global JS variable?

What are the security vulnerabilities arising from storing anti CSRF token as a global JS variable and use it for every requests made which need CSRF protection? If there are any vulnerabilities what ...
patrick jason's user avatar
0 votes
1 answer
326 views

Null origin CSRF in HTTP POST, is it possible?

Is it possible to construct an HTTP POST based CSRF attack with a null origin?
Shmolok's user avatar
1 vote
2 answers
974 views

Is my understanding of CSRF, SOP and CORS correct (Express / React)?

I am a hobby developer and am developing an application with a Node JS / Express backend and a React frontend. I am currently learning about Cross Site Request Forgery (CSRF), and I want to make sure ...
David's user avatar
  • 11
1 vote
1 answer
648 views

Can we set a custom CSRF token inside header requests to make a CSRF PoC?

I'm trying to create a PoC for a CSRF issue I found. The request contains the CSRF token inside the request header and the problem is that the server side is checking only if the token is available ...
Bomer Bom's user avatar
0 votes
1 answer
835 views

Is the .AspNet.Application cookie vulnerable to CSRF attacks?

I have an MVC application that has undergone SAST. The scan detects a potential XSRF/CSRF vulnerability. The application rewrites the .AspNet.ApplicationCookie setting SameSite=Strict: protected void ...
monkeySeeMonkeyDo's user avatar
2 votes
1 answer
568 views

Are these SameSite vulnerabilities still present today?

According to this ietf doc there are two vulnerabilities to samesite cookies: Attackers can still pop up new windows or trigger top-level navigations in order to create a "same-site" ...
jacob's user avatar
  • 103
0 votes
1 answer
77 views

Do I need to set up super global SESSION for a web form?

I am building a web form in PHP, is just for the user to request information about my services or send comments, so I don‘t need the user to be logged with a username and a password, no databse. I ...
limakid's user avatar
1 vote
2 answers
1k views

Is CSRF token vulnerable if CORS is enabled?

Let's analyze the following scenario: User authenticates with session cookie I have CORS enabled (like Access-Control-Allow-Origin: * - header) I use CSRF Token to prevent CSRF attacks and I include ...
Qback's user avatar
  • 113
0 votes
2 answers
1k views

Storing Anti-CSRF token in cookie with samesite=strict

The (anti) CSRF Token should protect user from executing a action on the website by clicking a link or a form that is created by an attacker. In the application that I want to secure I can't use an ...
key_'s user avatar
  • 1
2 votes
2 answers
2k views

How to access CSRF token in fronted when API is on different domain?

I am building a website with a separate Javascript frontend and a Django backend. My backend uses CSRF protection. Now the problem is that the CSRF token is being set on the client side as a cookie on ...
atskdev's user avatar
  • 23
0 votes
1 answer
681 views

Validating CSRF state with an OAuth2 POST Callback

I am setting up OAuth2 for Apple, and it requires a POST response to the callback URL if certain scopes (e.g. email address) are included. My intended process for preventing CSRF: Set a cookie with a ...
Russell S's user avatar
5 votes
1 answer
587 views

Are CSRF attacks a thing of the past?

If the default value for the samesite directive in the Set-Cookie header is lax, then surely the only way for a CSRF attack to work, is if the website's developer, for some reason, puts a less ...
David Klempfner's user avatar
0 votes
0 answers
96 views

Cookie-based sessions

During an engagement, i have been asked by a client to explain (with the use of one or more examples) whether having an authenticated cookie-session web upload functionality can be dangerous for the ...
pashani jaulani's user avatar

1
2 3 4 5
14