Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [csrf]

a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

0
votes
0answers
54 views

Static website CSRF alternative

We have a static website hosted on s3 behind a cloudfront, currently we store a user's sessionId in localStorage, then add this to the request body. We would like to migrate this solution to ...
0
votes
1answer
28 views

CSRF protection for an email subscription website - are there any risks of having it turned off?

I have a main website with an email subscription form. And my other websites where I have an email capture form. A user enters their email on those website and via POST he's redirected to the main ...
0
votes
0answers
37 views

CORS Anywhere to bypass CSRF protection

CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers. Can CORS Anywhere able to bypass CSRF protections? Reason to ask ...
3
votes
2answers
176 views
+100

Is this hybrid (cookie, jwt) authentication method for web applications known and practical?

I have been working with web applications for a while, some months ago I found a possible approach to get the security advantages from Browsers while using cookies for authenticating requests, with ...
0
votes
1answer
42 views

How to fix CSRF vulnerability alert on a website with no user authentication, If it is caused by an external Mailchimp signup form embed

A Website with no authentication has an mailchimp signup form embed. Vulnerability tools are reporting CSRF issues on the hosted website. Who can become victim in this case and how to prevent it and ...
1
vote
0answers
48 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
0
votes
0answers
12 views

What's the attack vector for authenticated wildcard CORS origin for a public API?

I have a public API (intended to be used by third-party websites) authentication only via JWT bearer tokens (no cookie authentication). SPAs have to add the Authorization header for every API request....
0
votes
1answer
70 views

When is it okay not to use anti-forgery token in login page?

In this post, there is a paragraph that mentions a scenario where there is no need to validate anti-forgery token in login page: When is it OK to leave off the anti-forgery token? In general, if ...
0
votes
0answers
43 views

What is double submit cookie? And how it is used in the prevention of CSRF attack?

I was looking at the CSRF prevention steps and was not able to understand how the double submit cookie works?
0
votes
1answer
20 views

How can the Cookie-to-header-token CSRF protection technique be thwarted by permissive CORS origin header?

According to https://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-header_token The protection provided by this technique can be thwarted if the target website disables its same-...
0
votes
2answers
111 views

Why not write the CSRF Token into the Session

I am currently developing a web page and came across the OWASP Cheat sheet about double submit cookies. I am now thinking that's a good idea but I didn't get why you are not storing the CSRF token ...
4
votes
1answer
88 views

How to implement CSRF protection with a cross origin request (CORS)

tl;dr the Cookie-to-header-token method can't work due to the CSRF token cookie not being readable by the client in any way. Is sending the token in a header, and having the client save it in a cookie ...
0
votes
0answers
31 views

JSON-CSRF using Flash SWF Doesn't make POST request

I was trying to recreate a POC where an endpoint didn't have CSRF protection and was exposing a form submission. So, I have read these ( before asking here ): Vimeo hackerone Report by avlidienbrunn ...
1
vote
1answer
50 views

Can the attacker view the response from a CSRF attack request? [duplicate]

In CSRF attacks, the attacker crafts a specific request and convinces the victim to visit the page. I have a doubt in one scenario. Suppose if the victim visits the page, and clicks on the button, ...
1
vote
1answer
49 views

How can I securely disable CSRF validation for native clients when browser clients access the same API?

I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients. How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls? ...
1
vote
1answer
55 views

OAuth 2 state token and protect CSRF

We are trying to build a set of REST APIs which will be authenticated by using attached ID token generated by an OAuth provider. I am trying to understand how to use the state token passed in with ...
0
votes
0answers
22 views

How does SupportsCredentials, Access-Control-Allow-Credentials, and CORS Origin=* relate?

I'm investigating CSRF implementations in ASP.NET, MVC, WebAPI the relationship between the headers that are sent: A Javascript client call of XMLHttpRequest.withCredentials A server response of ...
1
vote
1answer
49 views

Can XSS mitigate all anti-CSRF protections?

Say a website has the following form on their sign-up page: <form method="POST" action="https://example.com/login/"> <input type="hidden" name="x-csrf-token" value="[token]"/> <input ...
0
votes
1answer
33 views

Adding a static token to ZAP vulnerability scanner

I am currently trying to get the OWASP ZAP scanners working on a peculiar website. When authenticated on this website, each GET request needs a "token" (most likely a anti-CSRF token) as a parameter. ...
1
vote
0answers
26 views

Where to store encryption based tokens in Encryption based Token Pattern?

Reading OWASP encrypted tokens pattern they describe the flow as follow: After successful authentication, the server generates a unique token comprised of the user's ID, a timestamp value and a ...
1
vote
2answers
72 views

CSRF and defence mechanisms

I was reading some material about the defense mechanisms used to protect against CSRF attacks. I think I've a question about the one based on a secure token. As far as I know, a web application ...
29
votes
1answer
2k views

Is the core idea behind CSRF protection that the hacker doesn't know the token value?

I'm trying to fully understand the concept behind CSRF, and more importantly, how to protect against it. Can I assume, using only CSRF, so no XSS or other techniques, a hacker cannot know the value ...
1
vote
1answer
83 views

How can CSRF POST happen?

I realise this is a newbie question but when it comes to this im clearly that. On a browser, assuming one received a cookie from site A. Then a different site B makes a call to site A through it's ...
0
votes
1answer
175 views

SameSite cookie attribute and Synchronizer Token Pattern

Recently most browser have added support to the SameSite cookie attribute to prevent CSRF attacks: https://www.owasp.org/index.php/SameSite Question if it is supported should we implement ...
0
votes
1answer
95 views

Does having in-browser password managers further the risks of successful CSRF attacks?

When successful CSRF attacks are executed they have the ability to access credentials and other information between the victim and the site. Are the sites username and password that are stored in the ...
0
votes
1answer
116 views

CSRF Token for Anti Automation for multiple requests

Need some inputs for the CSRF token design to prevent anti-automation. 1. When a page loads for an user session, a request is given to the server, which would fetch the CSRF token , returned as part ...
0
votes
1answer
61 views

Heuristics to Identify CSRF from Web Access Log File

I am new here in security. I want to identify suspicious users on web application by analyzing web access log file. For this, I am considering CSRF attack. For this purpose, I am generating some ...
2
votes
2answers
129 views

CSRF methods: img vs iframe vs form/javascript

I have a questions concerning methods for executing CSRF. I did the CSRF Prompt By-pass lesson in WebGoat (Lessons -> Cross-site Scripting -> CSRF Prompt By-pass). The lesson requires you to craft an ...
2
votes
2answers
60 views

What are the common features to identify CSRF attack from Apache log file?

I have tried CSRF attack on web vulnerability application known as DVWA at my localhost and on kali linux OS. I have changed password on this application by using CSRF. It has collected following log ...
1
vote
0answers
167 views

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

In the context of a web application... should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
0
votes
1answer
142 views

Not convinced on the security of a JWT Token + CSRF Token

Lets suppose I have a web application that uses JWT tokens and CSRF Tokens in its authentication scheme. As I understand it, it works like this: When a user logs in, the client sends a login request. ...
1
vote
2answers
142 views

What to do about vulnerability in a SaaS product I buy?

I work for a university, where I am part of the team responsible for integrating a SaaS Learning Management System (eg: Moodle, Canvas) with the rest of the university's systems. Two months ago, I ...
1
vote
0answers
24 views

SOP for an API specifically serving a single SPA [duplicate]

SOP (same origin policy) provides some security for the users against some attacks, but it is not very strict as it still allows you to send GET and POST requests from a different origin that APIs by ...
-1
votes
2answers
125 views

High Level CSRF

I have been doing a bit of dvwa (damn vulnerable web application) and I have a question on CSRF. There is an additional parameter, a csrf token, which is submitted in the get request. All the answers ...
0
votes
1answer
138 views

How to exploit CSRF using HTML form to save data? [duplicate]

So I found a CSRF vulnerability on a website. The website is sending GET request to get user data and there is no protection. So using HTML I can get the data from the website if the user is logged in,...
1
vote
1answer
68 views

How to prevent two-stage CSRF attacks?

Assume that we are creating a CSRF token and inject it in a form on the page sendmoney.php. What prevents the attacker from sending a request to sendmoney.php to get the CSRF token and then submitting ...
4
votes
1answer
285 views

Can oauth2 “state” parameter be used to avoid using session cookies to identify user

https://tools.ietf.org/html/rfc6749#section-4.1.1 states: 4.1.1. Authorization Request" "state" RECOMMENDED. An opaque value used by the client to maintain state between the ...
1
vote
0answers
61 views

Do I need CSRF Protection? [duplicate]

I have a Rest API that is located at api.example.com. The user logs in at app.example.com and gets a Cookie which contains the authentication related information and handles the session. Every page ...
1
vote
2answers
196 views

POST Method Anti-CSRF Help With Burp Suite

I am testing a web application and encountering anti-CSRF tokens within forms which is hampering fuzzing attempts using Burp Suite intruder. An anti-CSRF token appears as csrf-token within a HTML meta ...
1
vote
0answers
36 views

Automatic Paypal payment through API

I am building a game similar to HQ trivia, that when someone gives all the correct answers at the end of the game he or she gets money sent to their Paypal account, my concern is obviously security. ...
1
vote
4answers
146 views

Is it OK to put the CSRF token in a cookie?

I am developing CSRF protection with a token for one of my applications. Since there is no place to implement the token in POST or GET or form data, I am thinking about putting it in a cookie. Is that ...
5
votes
3answers
625 views

Is CSRF still a relevant attack vector?

CSRF was part of older OWASP TOP 10 lists but has been retired "as many frameworks include CSRF defenses, it was found in only 5% of applications". But even without frameworks doing CSRF defense, I've ...
0
votes
2answers
83 views

What are the places one should look for CSRF flaw? [closed]

While finding vulnerabilities in a web app what are the potential areas where one should look for CSRF flaw?
1
vote
2answers
66 views

Why most of the web applications use CRSF token as a prevention method instead validating through origin header?

Why was crsf token discovered at the first place? One can always check from the the request generated by origin header
1
vote
2answers
186 views

Can a site vulnerable to XSS be used to attack a site with a CSRF vulnerability?

I heard of the attacks Cross Site Scripting (XSS: An attack where an attacker injects malious client side code (For example: JavaScript) into a web application.) and Cross Site Request Forgery (CSRF: ...
2
votes
2answers
512 views

XMLHttpRequest CSRF fails with allowed CORS

I'm currently working on a PoC for a CSRF attack, which should be possible due to the lax CORS configuration. I have a permission to attack. Now the following code should send a OPTIONS request, ...
0
votes
1answer
181 views

A different CSRF token and session ID passed in the request [closed]

A CSRF token is what a server includes in its response, that is the same token which is passed in the request from the user. In my case, a different CSRF token is getting included in the request- ...
1
vote
2answers
177 views

Can I put the session token in the body to protect against CSRF? [duplicate]

Say I have a user with an associated session token. This user wants to delete his account, and so he goes to its associated link. I, trying to protect my users and myself from CSRF attacks, have it so ...
1
vote
1answer
47 views

How does Software Defined Perimeter (SDP) protect against certains attack that happen in the browser?

I have been doing a bit of research on SDP (Software Defined Perimeter) but it's still a bit unclear to me how it protects against certain types of attacks. On Wikipedia it says that it can protect ...
1
vote
0answers
72 views

CSRF protection and Single Page Apps on hosted on S3 (with no backend.)

I have a webapp written in js that runs on AWS S3. There is no way to initialize a secure CSRF token on page load since there is no backend server. The token has to be retrieved via an AJAX call to my ...