Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [csrf]

a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

0
votes
0answers
14 views

Using Referer/Origin request header to prevent CSRF [duplicate]

I'm testing a web application checking the Origin or Referer request header as a CSRF prevention mechanism. I could not find a way to bypass these checks and they seem to be implemented reasonably ...
1
vote
0answers
18 views

SOP for an API specifically serving a single SPA

SOP (same origin policy) provides some security for the users against some attacks, but it is not very strict as it still allows you to send GET and POST requests from a different origin that APIs by ...
-1
votes
2answers
52 views

HIGH LEVEL CSRF

I have been doing a bit of dvwa(damn vulnerable web application) and I have a question on CSRF. There is an additional parameter, a csrf token, which is submitted in the get request. All the answers ...
-1
votes
0answers
29 views

Client-side csrf/ hash based csrf

While working on a web app, I came across an endpoint which deletes an item when sent via GET request. http://example.com/v1/#/branch/123456789/delete which can only be a GET request to this endpoint ...
0
votes
0answers
34 views

Send POST request to Parent which will submit form in 3rd party iframe Child [closed]

How would i go about sending POST request which will submit this 3rd party form on Parent to child? Is this possible? not CSRF protected
0
votes
1answer
48 views

How to exploit CSRF using HTML form to save data? [duplicate]

So I found a CSRF vulnerability on a website. The website is sending GET request to get user data and there is no protection. So using HTML I can get the data from the website if the user is logged in,...
1
vote
1answer
58 views

How to prevent two-stage CSRF attacks?

Assume that we are creating a CSRF token and inject it in a form on the page sendmoney.php. What prevents the attacker from sending a request to sendmoney.php to get the CSRF token and then submitting ...
4
votes
1answer
50 views

Can oauth2 “state” parameter be used to avoid using session cookies to identify user

https://tools.ietf.org/html/rfc6749#section-4.1.1 states: 4.1.1. Authorization Request" "state" RECOMMENDED. An opaque value used by the client to maintain state between the ...
1
vote
0answers
56 views

Do I need CSRF Protection? [duplicate]

I have a Rest API that is located at api.example.com. The user logs in at app.example.com and gets a Cookie which contains the authentication related information and handles the session. Every page ...
1
vote
2answers
81 views

POST Method Anti-CSRF Help With Burp Suite

I am testing a web application and encountering anti-CSRF tokens within forms which is hampering fuzzing attempts using Burp Suite intruder. An anti-CSRF token appears as csrf-token within a HTML meta ...
0
votes
0answers
24 views

Oauth2 vulnerable authentication flow with state parameter

As per my understanding, this is the standard authentication flow to log in a user using auth service provider; But I've seen some framework and examples, where they build authentication URI at ...
1
vote
0answers
26 views

Automatic Paypal payment through API

I am building a game similar to HQ trivia, that when someone gives all the correct answers at the end of the game he or she gets money sent to their Paypal account, my concern is obviously security. ...
1
vote
4answers
119 views

Is it OK to put the CSRF token in a cookie?

I am developing CSRF protection with a token for one of my applications. Since there is no place to implement the token in POST or GET or form data, I am thinking about putting it in a cookie. Is that ...
4
votes
3answers
578 views

Is CSRF still a relevant attack vector?

CSRF was part of older OWASP TOP 10 lists but has been retired "as many frameworks include CSRF defenses, it was found in only 5% of applications". But even without frameworks doing CSRF defense, I've ...
0
votes
2answers
79 views

What are the places one should look for CSRF flaw? [closed]

While finding vulnerabilities in a web app what are the potential areas where one should look for CSRF flaw?
1
vote
2answers
55 views

Why most of the web applications use CRSF token as a prevention method instead validating through origin header?

Why was crsf token discovered at the first place? One can always check from the the request generated by origin header
1
vote
2answers
111 views

Can a site vulnerable to XSS be used to attack a site with a CSRF vulnerability?

I heard of the attacks Cross Site Scripting (XSS: An attack where an attacker injects malious client side code (For example: JavaScript) into a web application.) and Cross Site Request Forgery (CSRF: ...
1
vote
2answers
59 views

XMLHttpRequest CSRF fails with allowed CORS

I'm currently working on a PoC for a CSRF attack, which should be possible due to the lax CORS configuration. I have a permission to attack. Now the following code should send a OPTIONS request, ...
0
votes
1answer
66 views

A different CSRF token and session ID passed in the request [closed]

A CSRF token is what a server includes in its response, that is the same token which is passed in the request from the user. In my case, a different CSRF token is getting included in the request- ...
1
vote
2answers
102 views

Can I put the session token in the body to protect against CSRF? [duplicate]

Say I have a user with an associated session token. This user wants to delete his account, and so he goes to its associated link. I, trying to protect my users and myself from CSRF attacks, have it so ...
1
vote
1answer
34 views

How does Software Defined Perimeter (SDP) protect against certains attack that happen in the browser?

I have been doing a bit of research on SDP (Software Defined Perimeter) but it's still a bit unclear to me how it protects against certain types of attacks. On Wikipedia it says that it can protect ...
1
vote
0answers
32 views

CSRF protection and Single Page Apps on hosted on S3 (with no backend.)

I have a webapp written in js that runs on AWS S3. There is no way to initialize a secure CSRF token on page load since there is no backend server. The token has to be retrieved via an AJAX call to my ...
1
vote
1answer
44 views

CSRF Testing. Validation Error 422. Locale Required

So I'm testing this site for coursework and I think it might be vulnerable CSRF however when I try to make a post request I get a validation error which says "locale" is required despite me specifying ...
2
votes
1answer
173 views

CSRF Protection Is Needed for GET Requests

I have a REST API that allows authenticated users to read data about their own account and make changes to their accounts. For authentication I use JWTs stored as httpOnly cookies. To protect against ...
1
vote
1answer
71 views

Origin Header Vs Token based mitigation

OWASP CSRF Prevention cheatsheet talks about two popular mitigations for CSRF - Origin/Referrer header check and Token based. Are there any issues Origin/referrer check based mitigation that could ...
0
votes
2answers
261 views

CSRF Origin and Referer Header just check host?

Note: This question is not the same as the linked possible duplicate. That question asks how checking the origin/referer header protects against CSRF. This questions is asking how to implement the ...
0
votes
0answers
42 views

Microservices: JWT and Springboot

I'm developing a backend infrastructure based on microservices. I'm using Springboot framework. Regarding the authentication and authorization phases, I would use Oauth2 + JWT. That's mainly because ...
2
votes
1answer
94 views

csrf token placement

I know there are multiple places to put a csrf token and the most common one is to put in a hidden input field in a form. Second is in a cookie with the httpOnly flag. What I want to know is, is there ...
0
votes
1answer
171 views

If CSRF tokens are embedded in meta tags, how do they offer security?

If someone is using my website, and they close a tab, then the CSRF token is now gone on the client side, because it was embedded on the page. If that same person opens the site in a new tab, the page ...
2
votes
0answers
89 views

How does the Ruby on Rails CSRF Protection Work?

I am not sure i completely understand how Ruby on Rails handles CSRF protection. My understanding was that a token is generated and embedded in the HTML markup as a meta tag, and at the same time ...
1
vote
1answer
45 views

What is the “validity scope” of a browser cookie?

Consider the standard CSRF protection of a Ruby on Rails application: a CSRF token is embedded in the HTML page, while at the same time stored encrypted as part of the session cookie. When making a ...
5
votes
1answer
319 views

Do I need CSRF protection in this setup with a REST API backed with oauth2 and a basic auth SSO auth server?

I've seen the answer Is CSRF possible if I don't even use cookies? but there are 2 conflicting answers and the question itself doesn't provide that much information either. I am creating a REST ...
0
votes
2answers
212 views

is every site without a CSRF token vulnerable to CSRF attack?

I found a lot of popular sites not having crsf token in cookie header, does that mean all of these sites are vulnerable? I tried to learn more about it and found there's something called CORS which ...
3
votes
1answer
472 views

Two solutions for CSRF on OWASP for ASP.NET WebForms

I am confused about differences between those two solutions from OWASP ASP.NET Web Froms Guidance Solution one: While viewstate isn't always appropriate for web development, using it can provide ...
9
votes
1answer
547 views

Current status of SameSite cookie

Recently I got to know about SameSite cookie attribute which is used to mitigate the CSRF attacks. AFAIK SameSite attribute for cookies is implemented in Chrome and some other browsers. Since I'm ...
1
vote
1answer
293 views

Why are cross-domain POST requests allowed? [duplicate]

I understand that best practice is to use tokens to prevent CSRF, but why do browsers permit cross-site POST requests in the first place? It seems like giving untrusted parties unfettered write ...
0
votes
1answer
117 views

Obtaining CSRF Token

As I have read about CSRF tokens, the server usually embeds the CSRF token in the form on a hidden tag. In that way, when submitting the form as a POST request, the CSRF token can be sent and received ...
2
votes
1answer
81 views

Why can CSRF attack be prevented by issuing CSRF tokens?

The common way to prevent CSRF requests: Each time the user loads a page that contains a form to be POSTed, the user is issued a CSRF token that it supposed to be unknown to potentially malicious ...
3
votes
3answers
127 views

Why are CSRF vulnerabilities considered to be a problem with the web app, rather than with the browser?

From microsoft docs: CSRF vulnerabilities are fundamentally a problem with the web app, not the end user. And indeed, the typical solution (CSRF tokens) is a server-side solution rather than ...
3
votes
1answer
415 views

Authentication with JWT

I am building SPA (React/Redux) and require user authetification. I have found similar discussions, but haven't found answers for questions I outline below. Here are some options I found to implement: ...
0
votes
1answer
324 views

Is CORS and CSRF-tokens only for POST and GET requests? [closed]

I have the following questions regarding CSRF, SOP and CORS. Does CSRF tokens only protect form submission with either POST or GET methods? Is this just a "common practice" (regarding the fact that ...
4
votes
3answers
235 views

What is the quick fix for CSRF attack?

The application is constructed in Java language and JSF framework. I have reported a CSRF attack and the development team have to fix it soon since the application is in production. I recommended to ...
0
votes
0answers
148 views

Single Page Application and CSRF Token generated every time

I need to use a Single Page Application (React, Ember, Angular, I don't care) with Rails CSRF protection mechanism. I'm wondering if I need to create a token evey time in the ApplicationController ...
1
vote
2answers
86 views

Why are third party cookies sent to second party websites?

When I visit this website, Google Analytics cookies are being sent to it from my browser along with the request. This goes against my whole understanding of cookies which is that cookies are only ...
3
votes
1answer
221 views

Is some kind of CSRF possible using img/script tag to read sensitive information

Let's say i have an API at https://mysite/api/getSensitiveData that: Uses GET Protected with cookie authentication Returns JSON with some sensitive data A bad guy creates a site on his server that ...
1
vote
1answer
252 views

Prevent CSRF on public website with no login

I am working on a web project that let a person send a request form to my API. Every visitor can send a request through that form without login. Currently the API generates a token when the page is ...
44
votes
3answers
8k views

Why don't browsers block cross-site POSTs by default?

Same-origin policy (SOP) makes browsers block scripting from one origin to mess with another, unless explicitly being told not to do so. But cross-site POSTs are still allowed, creating the vector for ...
1
vote
1answer
151 views

CSRF tokens in cookies?

I've seen some websites use CSRF tokens in the cookie field like _csrf=123abc and not as a separate header or as part of POST data. My question is, when a attacker's website makes a CSRF request ...
0
votes
1answer
190 views

Preventing CSRF/XSS on mobile/web shared API

I have inherited a code-base that includes a mobile & web app that both access the same API and have been tasked with fixing some of the security holes that exist, unfortunately I am not well-...
0
votes
1answer
328 views

CSRF token for API serving application

Currently, my architecture as follows. API is served from api.domain.com. Frontend application is served from frontend.domain.com. I'm concidering two different methods for CSRF protection: Letting ...