Questions tagged [csrf]

a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

Filter by
Sorted by
Tagged with
1
vote
2answers
75 views

Cross-Domain Request is a CSRF Attack? (CORS)

CORS is a HTTP Suite header that “relax” the SOP. One of the CORS misconfigurations is about to reflect without reg exp the “Origin” client header into “ACAO” response header. If it happens with “ACAC:...
3
votes
0answers
78 views

Should you terminate a session when an incorrect CSRF token is submitted?

According to the OWASP CSRF Prevention Guide if the server fails to ...verify the existence and validity of the token in the request compared to the token found in the user session ... then the ...
0
votes
0answers
19 views

Where can i find json based csrf lab? [closed]

Where can I find JSON based CSRF lab? I need to practise it. Also, if you can then develop a small good PHP or python website which is JSON CSRF vulnerable and share it on github. I have tried making ...
2
votes
3answers
96 views

Do I still need CSRF protection when SameSite is set to Lax?

During a security assessment I noticed that Firefox automatically set the SameSite value of a session cookie to Lax. According to the Mozilla specs, this is the case for 'modern browsers'. The ...
0
votes
1answer
21 views

Can you set a custom x-forwarded-host header in a CSRF form page?

Can you set a custom x-forwarded-host header in a CSRF form page (not xhr)?
2
votes
1answer
27 views

CSRF: GET request with POST data?

I have stumbled upon a vulnerability in a web application and was wondering if it was exploitable / worth reporting. The bug is a CSRF which would allow an attacker to send friend requests to himself ...
0
votes
1answer
64 views

CSRF Bypass using User-Agent

This is an unconventional approach of CSRF that I came across while doing the pentest for an Android mobile application. The original request is as follows (NB: Values have been edited): POST /edit/ ...
0
votes
0answers
61 views

XSS Bruteforcing results in 500 internal server error

I've been trying to trigger xss in a website with the following url https://website.com/login/error?username_or_email=xyz%40gmai.com&redirect_after_login=%2wall While trying different payloads ...
0
votes
0answers
31 views

URL editing shows success message, but doesn't carry out function [closed]

I've been looking into my college's internal alumni network. In that we can send connections to users and when you send a connection request, you're taken to a url which is: https://www.website.com/...
0
votes
2answers
78 views

How to prevent CSRF attacks on a REST API when using Windows Authentication

I have a Angular web app that interacts with a REST-API. Requests are authenticated with a JWT Bearer token. I now want to add support for Windows-Authentication. My current plan is to add a POST-...
0
votes
2answers
58 views

How to “trust” data that is posted from one application to other

We have a use case where a bunch of data needs to be posted from our application to a partner site where the end user takes some actions and then returns back to our site. On the return, the partner ...
0
votes
0answers
20 views

Regenerating CSFR token in AJAX requests

I would like to create a new token for each request and would like to us the following template- <script> var current_token=<?php echo $_SESSION['csrf_token']; ?> $....
2
votes
0answers
46 views

What's the point of salting Double Submit Cookie (CSRF protection)?

Django web framework uses the Double Submit Cookie pattern for CSRF protection. (The CSRF token is sent in a cookie and also in a hidden form field. Incoming requests are checked for a match between ...
0
votes
0answers
35 views

What is the correct way to implement the OAuth2 state parameter?

I'm trying to understand how to properly implement state in an OAuth2 client, to mitigate CSRF attacks. This answer explains the attack scenario pretty well, to summarize: The attacker starts the ...
1
vote
2answers
51 views

Is CSRF prevention logic required for api that is consumed only by mobile app?

I am developing an ASP.NET Core web api project whose only client will be a mobile app developed in Xamarin. There will be no web frontend for the application. Can CSRF attacks be executed if the ...
0
votes
1answer
43 views

Prevent Cross-site WebSocket hijacking with a custom header and no CORS

Considering I am vulnerable to Cross-site WebSocket hijacking, so my WebSocket handshake (GET to example.com/wss) does not require a random (CSRF) token. I have defined no CORS settings, so no custom ...
-1
votes
2answers
34 views

Is CSRF possible if i know the value of the authorization bearer token?

If i know the value of bearer token of the victim, can i generate a get csrf page and set a custom Autorization: Bearer [token] header?
-1
votes
2answers
74 views

What is the real purpose of csrf tokens?

When we are dealing with form pages, the recommendation is to use tokens to prevent csrf attacks. I see many csrf tokens set as a hidden HTML field or in the user cookies/headers. I thought that csrf ...
0
votes
0answers
57 views

A mesh of Cookie in Header & HttpOnly token - secure “enough”?

This is another attempt of mine to make sense of securing my web-app, which is built with two frameworks: Django REST API - serves as the backend. It generates both a token upon correct login, and a ...
0
votes
1answer
39 views

Check the origin header server-wide in IIS to prevent CSRF through the IIS configuration change Only

Could you please let me know how can we check the origin header server-wide in IIS to prevent CSRF through the configuration change only without adding a custom HTTP module in IIS?
0
votes
0answers
72 views

How to bypass origin based csrf protection?

I'm trying to do some csrf attack test on a site. I found that the site protect itself from csrf by checking the http Origin header. But I guess maybe under some conditions I can bypass the ...
3
votes
1answer
87 views

Retrieving CSRF token from third party website form using XHR (JavaScript)

I know they say CSRF tokens are the most secure way to prevent CSRF attacks but what if someone uses XHR to retrieve the page containing the csrf token along with the form and then use that token for ...
4
votes
1answer
233 views

Is it safe to create a session from an auth token?

My server is using Django Rest Framework. My mobile app logs in using token authentication. However, I also have a webview in the mobile app where I need to log in. I can't inject the auth token on ...
1
vote
1answer
70 views

Do browsers send cookie on Cross Site GET request?

I am able to make cross site requests because I have enabled CORS. I read about CSRF vulnerability which is caused by the fact that browser sends cookie when making a form POST request. I tried to ...
0
votes
0answers
59 views

How to secure API used by third-parties?

What I am building is service that can be consumed by third-party. Something like Omdb API for example. For my service to be functional I needed to disable CSRF on some endpoints. How can I secure ...
1
vote
3answers
68 views

What is the best defense for a multi-layered attack: Spoofing, MiTM, Login CSRF?

How would one go about defending against this sort of attack to best protect a sloppy user? There can be obvious signs of a spoofing attack, such as not using SSL, slightly different domain, etc, but ...
3
votes
1answer
87 views

Is CSRF protection required for sensitive GET requests with CORS enabled?

Based on other questions, it seems protecting GET resources with CSRF tokens is useless. However, that quickly becomes untrue when CORS gets thrown into the mix I have a server domain server.com and ...
2
votes
1answer
686 views

Generate CSRF token in SPA

I'm extremely confused on the topic of generating a session long CSRF token on a single page application using React. It looks like the convention is to have the server generate the CSRF token on log ...
0
votes
1answer
63 views

Is CSRF possible in a Client Application?

So i was testing a desktop application for first time and identified a possible endpoint vulnerable to csrf, but the problem i'm facing is that when i try to test it in a browser the request doesn't ...
2
votes
1answer
99 views

Is Tomcat protecting against CSRF correctly?

If I read this correctly the way Tomcat protects against CSRF leaves it vulnerable to the situation where the CSRF token is duplicated in the cookie and request parameters which allows the attacker to ...
1
vote
0answers
43 views

CSRF Mitigation With Cookie Same-Site

wanted to get some advise in our OAuth process of getting token from 3rd party. Any comment would be appreciated! User click a short link and rediredirected to original link https://webssite.com/...
0
votes
1answer
132 views

For anti-CSRF, isn't a session id cookie in a hidden form field easier than a random token?

I sometimes run into sites with CSRF bugs and I want to know the simplest way to recommend for the developer to fix it. (i.e., if I tell them "Switch to a framework that has anti-CSRF protection", ...
0
votes
0answers
48 views

Why SetCookie's SameSite directive applies the destination rather than the origin?

I understand that the SameSite directive tries to protect against cross-origin leakages and CSRFs (see OWASP), but I don't get why (on my browser at least) it applies to the cookie's destination ...
1
vote
1answer
84 views

If an application has an XSS vulnerabilty, can we bypass CSRF with referer header?

Let's say there is an XSS vulnerability in an application, and the application is not using any kind of CSRF token, just using the referer header to protect against CSRF. Referer header is validating ...
0
votes
0answers
70 views

Do best practices eliminate the need for a CSRF token when writing an API server?

I realize that OWASP recommends CSRF tokens but I rarely see them used with public standalone HTTP APIs. This would seem to indicate that they're not always necessary. To make this a little more ...
1
vote
1answer
105 views

Same origin policy for CSRF attack?

Per mine understanding, by default same origin policy(SOP) is enabled by default by all browsers. This means that a web browser permits scripts contained in a first web page to access data in a ...
21
votes
3answers
4k views

For SameSite cookie with subdomains what are considered the same site?

For the samesite cookie attribute I'm not clear on if I set a cookie with domain .example.com from sub.example.com with the samesite attribute, if it will be considered the same site as other.example....
-3
votes
1answer
110 views

What led to the prominence of storing JWTs in localstorage?

Could somebody explain how and why a majority of new webapps are storing their JWTs/tokens in localStorage? It doesn't seem to be by chance, anyone familiar with this history and perhaps factors from ...
2
votes
1answer
127 views

XSS chained with CSRF = Stored XSS?

I have recently heard that XSS + CSRF = stored XSS. I didn't think too much about it at the time, but now it's bugging me, because it doesn't make too much sense. I would say that it can stand true, ...
0
votes
0answers
102 views

Custom header to avoid CSRF attacks? header without token

I found that a website protects itself of CSRF attacks by validating the POST request contains a specific header: -Example-header: GF What i find strange is that this header doesn't have a csrf ...
2
votes
0answers
59 views

Are the trade offs for putting an auth token in an http-only cookie for an SPA worth it?

I've been building a web app (rails api + react SPA) for learning / fun and have been researching authentication. The most commonly recommended approach for authenticating SPAs that I have read is to ...
0
votes
1answer
92 views

Clarification of relationship between CORS and CSRF [closed]

To summarize: CSRF is an attack where a page in a different window/tab of the browser sends nonconsensual request to an authenticated web app, that can typically be prevented from server-side by ...
3
votes
1answer
134 views

Perform CSRF attack when CSRF token is sent in custom request header? [duplicate]

I have found that the web application uses a weak algorithm to generate CSRF token. The CSRF token is sent in a request header: X-CSRF-TOKEN: "token-string" Since the request header is being used, ...
3
votes
0answers
66 views

Shopify OAuth: State parameter useful when the auth server also returns a signed shop id?

Background: I think I understand how the state parameter is used in oAuth to prevent CSFR attacks against the redirect_uri. Situation: I am looking at this in the context of implementing a Shopify ...
0
votes
0answers
113 views

Spring Security Stateless CSRF implementation in Logout

I have implemented a StatelessFilter which checks the CSRF token in the Cookie and in the headers. package com.leadwinner.sms.config.filters; import java.io.IOException; import java.util.ArrayList; ...
1
vote
1answer
939 views

Is the double submit cookie pattern still effective?

I ran across this OWASP paper and was frankly confused. I thought this pattern was still one of the cornerstone strategies against CSRF but the paper seems to say it's broken. Should this pattern ...
1
vote
1answer
385 views

Preventing CSRF with SameSite=“strict” without degrading user experience?

ASP.NET will soon begin reflecting Google's decision to default cookies to SameSite="strict" in a defense against CSRF attacks: https://devblogs.microsoft.com/aspnet/upcoming-samesite-cookie-changes-...
1
vote
0answers
1k views

Implementation of Simple CSRF in Spring Boot and Angular 6 With Complete Solution

I am Implementing CSRF i.e Cross-Site Request Forgery in my project but not getting proper way to implement in my project and i am using Angular for FrontEnd and Java for BackEnd in Spring Boot and I ...
0
votes
1answer
223 views

Is it secure to use a hash of a login token as an anti-csrf token?

Alright here is my proposal: Use a hash of a login token as the anti-CSRF token. Why this is a good idea? Prevents having to store anything extra on the client, the server, and less network traffic ...
1
vote
1answer
68 views

How do I automatically add a user login token to my csrf page?

I'm testing my own system, and I was wondering if the csrf login token I created there could be obtained from the user session. For example; <input type="hidden" name="login&#95;token" value="...

1
2 3 4 5
12