Questions tagged [csrf]
a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.
706
questions
0
votes
0
answers
28
views
Balancing security with usability when using nonce for CSRF protection [duplicate]
How does one balance security and usability when using nonces on a website?
Imagine a website where the same nonce is embedded in the page, and stored in the browser session.
If I were to replace the ...
- 2,169
0
votes
1
answer
27
views
Understanding Cross-Domain Cookies and `SameSite` Attributes with Express.js and Third-Party Tracking
What I have understood (I guess):
Cross-origin Cookies:
Cookies set with Domain="example.com" are not sent with fetch requests from origins like hello.example2.com to mywebsite.example.com ...
- 129
3
votes
1
answer
157
views
OAuth 2.0 - why is the state parameter needed in order to prevent CSRF at authorization code login flow?
I'm having a really hard time understanding why the state should be used to protect against CSRF at the OAuth 2.0 login flow.
Imagine I have an Authorization Server with a legitimate client registered ...
- 155
2
votes
4
answers
1k
views
HTTPs compression, CSRF and mobile apps
I have a backend for a mobile application that has to serve large JSON responses from time to time, the transfer would be greatly helped by enabling compression, especially when the user has bad ...
- 123
3
votes
1
answer
206
views
CORS credentials option set to true
To allow cookies to be sent to my ExpressJS server,credentials: true has to be set in my CORS config.
What potential security risks/ vulnerabilities could arise from this configuration?
If possible, ...
- 73
0
votes
1
answer
111
views
Does the absence of CSRF tokens need to be fixed as soon as possible?
When I was originally developing my website, I made sure to include cross-site request forgery tokens in most endpoints and forms, etc., because I knew it was a highly recommended thing to do.
But of ...
- 1,454
1
vote
2
answers
207
views
CSRF Prevention Using Signed Cookies And Custom Headers
Recently I was reading about CSRF prevention techniques like Synchronizer Token, Cookie-to-header, and Double Submit Cookie. Cookie-to-header is good for websites using a lot of JavaScript, e.g. SPAs, ...
- 13
1
vote
2
answers
149
views
Questions regarding CSRF using Client Side redirect
I have read an article about CSRF bypasses when a cookie set with Samesite: Strict.
Normally if a cookie is set with Samesite: Strict then it will not be sent in a cross origin request. But if the ...
0
votes
0
answers
551
views
Lax SameSite and POST (2 minute)
I was going through this link https://medium.com/@renwa/bypass-samesite-cookies-default-to-lax-and-get-csrf-343ba09b9f2b to understand CSRF using samesite. Does that mean that the LAX+POST issue has ...
- 183
0
votes
1
answer
81
views
javascript app preventing csrf
I am trying to implement measures against csrf in my client spa.
I have the following question, since it is difficult for me to use the Signed Double-Submit Cookie.
It is possible to implement a csrf ...
0
votes
1
answer
194
views
Double Submit Cookie Bypass
I am trying to work on an example for my class on how double submit cookie works and how attackers can bypass it
The idea i have is I have two domain att.com and victim.com. The login functionality on ...
- 183
0
votes
1
answer
198
views
No csrf token, instead sessiontokens?
Will a random-generated-session-key be enough, so that I can end the usage of csrf token? The front end, will receive the token when logged in. It will be stored in «local storage» at the client’s ...
4
votes
2
answers
1k
views
HTTPonly token without CSRF is safe?
How can a hacker steal my session where my form does not have CSRF tokens but my session cookies are HTTPonly? how would he get my session cookie in this case? is this possible?
for example, to be ...
- 43
1
vote
1
answer
115
views
Why wouldn't a site's cookies be sent in this scenario?
I'm reading an article on Okta's engineering blog, which contains the following paragraph:
Some of the disadvantages of cookies include:
Cross-site request forgery attacks (XSRF or CSRF): CSRF ...
- 113
3
votes
1
answer
796
views
OIDC with JWT in HTTP-only cookie instead of HTTP Authorization bearer header
I'm exploring the possibility of implementing OpenID Connect (OIDC) with an HTTP-only cookie to keep my frontend code completely authentication-agnostic, instead of passing the Authorization header ...
- 131
0
votes
1
answer
236
views
Necessity of CSRF Protection with ID Token Authentication in Firebase
I recently came across a statement in the Firebase documentation that suggests "CSRF protection should be taken into account." This guidance appears in the context of using an ID token for ...
- 101
0
votes
1
answer
239
views
Does Firebase App Check provide CSRF protection?
Quoting the OWASP Cheat Sheet on CSRF Prevention:
Using the Synchronizer Token Pattern:
CSRF tokens should be:
Unique per user session.
Secret
Unpredictable (large random value generated by a secure ...
- 53
0
votes
0
answers
234
views
do I need anti-csrf-tokens or double submit cookie pattern?
currently I'm working on a NestJs backend. I have already implemented the auth feature with jwt (access and refresh) stored in cookies. Originally I sent the jwt by the standard Bearer token way in ...
- 101
0
votes
0
answers
93
views
Security frontend side
Hi i´m a frontend developer and next week we will have a security audit i need to be sure that frontend side is secure and dont have vulnerabilities, so my question is, ¿What would you recommend or ...
0
votes
2
answers
199
views
Why do most examples of CSRF use roundabout ways of executing an API call instead of just using pure Javascript?
When I see examples of CSRF attacks, it is almost always explained with someone entering some external API url in an <img> tag, e.g. <img src="bank.com/transfer?amount=10000?recipient=...
- 1
0
votes
2
answers
151
views
Not requiring POST requests... results in a CSRF vulnerability?
I'm setting up a Jenkins server, and ran across a reported vulnerability, SECURITY-3033, also identified as CVE-2023-37954:
Rebuilder Plugin 320.v5a_0933a_e7d61 and earlier does not require POST
...
0
votes
1
answer
110
views
Is csrf protection required for extremely short lived cookies?
I have an app with token-based authentication (stateless).
for specific endpoint that serves an pdf file, it was ideal for me to authenticate via cookie.
so I creates a cookie with my access token, ...
- 103
0
votes
1
answer
281
views
CSRF on JSON with origin
I'm testing for CSRF vulnerability, and I have a request like this:
Host: www.test.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: ...
1
vote
1
answer
422
views
Do CSRF Tokens need to be tied to user IDs?
I am implementing a web system using Golang and have incorporated gorilla/csrf for CSRF protection. However, I've encountered an issue. When I have tab1 open in my browser, logged in as user1, and ...
- 11
1
vote
1
answer
345
views
What happens first in a request having both CSRF Token and JWT token, authentication or authorization?
This question came across my mind when I sent an ajax request from html to a backend django server and forgot to add a csrf token to the request payload and recieved this error.
403 error means that ...
1
vote
1
answer
4k
views
Secure alternative to csurf npm package
So the csurf middleware used in Node.js applications has been deprecated since Sept 2022 due to security vulnerabilities being discovered by Fortbridge in Aug 2022. However, it it still being ...
- 113
5
votes
1
answer
2k
views
Why is the browser not sending cookies with cross-domain WebSocket handshake request?
If I have understood Cross-Site WebSocket Hijacking (CSWSH) attack correctly [1][2][3][4], the attack relies on two things (examples are from the first reference):
the browser sending the cookies set ...
- 579
0
votes
1
answer
112
views
Correct implementation of a "User interaction based CSRF defense" approach?
OWASP CSRF Cheat sheet mentions the "User interaction based CSRF defense", which would also entirely mitigate a CSRF attack. I imagine that the reason OWASP considers it as a Defense-in-...
- 103
2
votes
1
answer
1k
views
CSRF: Signed Double Submit Cookie & 'Referer' validation vs MITM and vulnerable subdomains
I have been researching various techniques for preventing CSRF attacks, such as SOP, SameSite, Secure, Referer validation, and CSRF Tokens, and their potential bypasses. During my research, I ...
- 139
1
vote
0
answers
165
views
SSO Using API based login (not through UI redirection)
We have 3 different applications which have the same top level domain.
a.example.com
b.example.com
example.com
We have a login mechanism where the user provides a username + password and logs in. ...
- 303
2
votes
2
answers
956
views
When using double submit cookies as protection against csrf, does it matter where the random key is created?
I have a stateless backend and a spa-frontend. Except for the login request, all requests are secured by a jwt in the header.
Additionally the application should now be secured against csrf. Since the ...
- 121
1
vote
1
answer
599
views
Are CORS headers useless?
It is common to say that CORS headers protect against CSRF, so that if you visit a malicious website, it cannot make a request to your web application because the referer header (the URL of the ...
0
votes
1
answer
500
views
Session based CSRF Tokens - What value do i use with JWT?
The Double Submit Cookie CSRF Token pattern is a stateless technique that doesn't require storage or a database. However, it's vulnerable to session hijacking attacks and sub-/sibling domains that are ...
- 139
0
votes
1
answer
2k
views
Does CORS Access-Control-Allow-Credentials apply to non-origin/third-party cookies or as well?
I understand if you are cross-communicating with origin A, then if origin A has no Access-Control-Allow-Credentials in the response, you will never be able to reuse Cookies obtained from origin A ...
- 103
2
votes
2
answers
796
views
How to implement Double Submit Cookie with Encryption or HMAC
I'm trying to implement the Double Submit Cookie pattern with extra protection using encrypted or signed CSRF tokens. I'm working with a Single Page Application and a stateless API. The purpose of ...
- 121
0
votes
1
answer
206
views
How are Fetch Metadata Request Headers more secure than the Referer Header?
https://www.w3.org/TR/fetch-metadata/ for reference.
It seems like this is a simplified version of referer headers. Is the only advantage backend developer usability?
- 514
2
votes
1
answer
1k
views
Using CSRF token as state parameter for OAuth request
I recently completed Azure OAuth2 integration with my existing web application. Upon user's successful login into my application user can configure multiple outlook accounts using OAuth2 flow.
As for ...
- 123
1
vote
1
answer
775
views
About pre-session and login CSRF attacks with SPA REST API
We have react SPA application which call a back REST API. According to this paper (section 4.1) it is recommended to make a pre-session and then implement token-based CSRF protencion to stop login ...
- 113
2
votes
1
answer
1k
views
Is it possible to steal a cookie without HttpOnly via CSRF?
Without giving too many details away, let's say that I'm auditing an API that:
Has access-control-allow-credentials: true
Has access-control-allow-origin: *
Needs JWT set in Authorization header for ...
- 35
2
votes
2
answers
2k
views
Why do we need CSRF controls if session ID is used?
I am confused about this. Behavior and properties of both seem identical: both are generated server-side, should be cryptographically secure, with the lifetime not to exceed session duration. If all ...
- 456
2
votes
1
answer
751
views
Cookie flow in a site that hosts embedded Youtube video
When there's a Youtube video embedded on a site that I visit while I am logged in Youtube beforehand,how does the embedded video know that it's me so I can add it to my Watch Later list?
I think the ...
- 2,483
1
vote
0
answers
181
views
How can I manipulate certain server side responses? Specifically Ajax Responses? XXE Attack? Hybrid DNS Resolution?
I would like to be able to switch back and forth between the real DNS and maybe setting a local DNS entry so I can manipulate AJAX responses for code security checks.
For instance if the server ...
- 141
3
votes
2
answers
777
views
CSRF protection for oauth authorization
I've read a lot about the state parameter in oauth flow. But i cant quite understand if the state validation helps my use case.
end to end flow:
resource owner is redirected to service provider site(...
- 213
1
vote
2
answers
143
views
Should CSRF tokens protect against crafting a CSRF request by someone who has access to the same computer?
My server generates a random CRSF token if it doesn't find one in the cookies and saves it to the cookies encrypted, and supplies the raw token in the body of the response, to be read by an SPA and ...
0
votes
2
answers
377
views
Security vulnerabilities from storing anti CSRF token in global JS variable?
What are the security vulnerabilities arising from storing anti CSRF token as a global JS variable and use it for every requests made which need CSRF protection?
If there are any vulnerabilities what ...
0
votes
1
answer
376
views
Null origin CSRF in HTTP POST, is it possible?
Is it possible to construct an HTTP POST based CSRF attack with a null origin?
- 1
1
vote
2
answers
1k
views
Is my understanding of CSRF, SOP and CORS correct (Express / React)?
I am a hobby developer and am developing an application with a Node JS / Express backend and a React frontend.
I am currently learning about Cross Site Request Forgery (CSRF), and I want to make sure ...
- 11
1
vote
1
answer
721
views
Can we set a custom CSRF token inside header requests to make a CSRF PoC?
I'm trying to create a PoC for a CSRF issue I found. The request contains the CSRF token inside the request header and the problem is that the server side is checking only if the token is available ...
- 13
0
votes
1
answer
937
views
Is the .AspNet.Application cookie vulnerable to CSRF attacks?
I have an MVC application that has undergone SAST. The scan detects a potential XSRF/CSRF vulnerability.
The application rewrites the .AspNet.ApplicationCookie setting SameSite=Strict:
protected void ...
2
votes
1
answer
631
views
Are these SameSite vulnerabilities still present today?
According to this ietf doc there are two vulnerabilities to samesite cookies:
Attackers can still pop up new windows or trigger top-level
navigations in order to create a "same-site" ...
- 103