Questions tagged [csrf]

a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

Filter by
Sorted by
Tagged with
2
votes
0answers
35 views

Why is the .NET 5.0 antiforgery byte array length in bits not a common multiple of 6 and 8?

I was learning how antiforgery tokens work behind the scenes and wrote this article on the possible values a token can have. When the byte array is converted to base64, there are four left over bits ...
0
votes
0answers
31 views

Why does using JWT refresh tokens protect against CSRF during authentication?

I have read a few articles regarding JWT refresh tokens, and how/why they are used. One thing i have seen mentioned here: https://hasura.io/blog/best-practices-of-using-jwt-with-graphql/#persistance ...
2
votes
2answers
581 views

Is this test enough to proof that the web application is vulnerable to Login CSRF?

SCENARIO: web application which I think is affected by: a self-xss in the profile section of a user. logout CSRF login CSRF Below I described the test I did to check for the last 2 vulnerabilities, ...
1
vote
1answer
43 views

Does OpenID Connect provide CSRF and XSS protection?

I've been reading several articles recently about how storing JWTs in local or session storage is inherently insecure. The mitigation is apparently to implement a "session ID pattern", i.e. ...
1
vote
1answer
36 views

Is there benefit to an Anti-forgery cookie with sameSite:none?

We have a form that is using asp.net core AntiForgery validation. Recently encountered an issue with a form on the site hosted on www.domain.ie not being able to POST to the API at api.domain.co.uk ...
0
votes
2answers
118 views

How do I protect a Laravel backend API from hijacking/CSRF when there is a React frontend?

I'm finding it really hard to find a solution to make secure requests via our API without a potential hacker being able to see sensitive secret information via Google Chrome dev tools (or any browser'...
2
votes
1answer
47 views

CSRF payload delivery

If an attacker successfully delivers a CSRF payload by any means, what response can he can see once a victim clicks the link?
0
votes
1answer
61 views

CSRF token in SPA login JSON response?

Is it safe to include the CSRF token as part of an HTTPS successful login JSON response in an SPA? If not, is there a better mechanism for sending it which avoids the Double Submit Cookie pattern? ...
1
vote
1answer
53 views

Is server side CORS protection enough to mitigate CSRF attacks against stateless APIs?

Assume an Angular SPA application on www.example.com that works invoking an API over that same domain www.example.com/api/... The Angular app gets a session cookie and sends it in each API call. The ...
1
vote
1answer
51 views

Why using “state” variable in OAuth 2

I am building an application that is integrated with a 3rd party service provider and uses OAuth 2 to obtain permission from other users using the service to access their account information. Based on ...
8
votes
2answers
156 views

Why does Spring Security unset and set the same Cookie in one Request?

In the CSRF implementation of Spring Security (https://github.com/spring-projects/spring-security/blob/master/web/src/main/java/org/springframework/security/web/csrf/CsrfAuthenticationStrategy.java#...
0
votes
0answers
33 views

Double submit with signed CSRF token, is it safe?

In this article about CSRF, it is mentioned that the "double submit" protection can be circumvented by the attacker inventing a token and setting it as a cookie (through XSS I guess). Now ...
0
votes
1answer
109 views

Detailed explanations on OWASP Zap Security scan rules

As an example, I have installed Anti-CSRF Scanning rule in ZAP proxy and scanned a POST request which does not verify the CSRF token value from the back end. Ideally, it is a CSRF vulnerability, but ...
0
votes
0answers
49 views

Are application using custom header instead of CSRF token safe?

This application sends data to the server in JSON and checks for the content-type header, but I was able to bypass this, but it sends another custom header which is not a secret token or something ...
1
vote
0answers
18 views

Do __VIEWSTATEGENERATOR, __EVENTVALIDATION prevent CSRF? [duplicate]

I've seen __VIEWSTATEGENERATOR, __EVENTVALIDATION in every .NET website. Theirs value change, for example, at every login request. Do these fields prevent CSRF? If yes/no, why?
2
votes
1answer
75 views

Should I check Host header or ServerName for CSRF defense when serving behind proxies?

In a CSRF defense based on checking forbidden headers, should I check Origin/Referer header against the ServerName configuration directive, or is it sufficient to simply check against the HTTP Host ...
0
votes
1answer
43 views

Protecting an external authentication server against CSRF

I have a web application which uses an external authentication server for obtaining a session. When a client tries to login, the browser is making requests towards the external authentication server ...
0
votes
0answers
62 views

It's possible to bypass CSRF protection Referer-Based by spoof the referer in browser victim ? (POST-Based)

It's possible to bypass CSRF protection Referer-Based by spoof the referer in browser victim ? (POST-Based) Hello, i try to bypass a CSRF protection Referer-Based. I know the basic knowledge to bypass ...
0
votes
0answers
23 views

Why it is _the client_ (and not _the authorization server_) who is to validate the anti-CSRF state in OAuth workflow?

The client MUST implement CSRF protection for its redirection URI. This is typically accomplished by requiring any request sent to the redirection URI endpoint to include a value that binds the ...
2
votes
0answers
58 views

How can I implement CSRF Tokens without server-side rendering/templating?

I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
0
votes
0answers
23 views

How can the CSRF happen if browsers do not allow cross-origin requests by default? [duplicate]

How can the CSRF happen if browsers do not allow cross-origin requests by default? Brief CSRF overview, which is relevant for the question. CSRF is a type of attack (i.e. cross-site request forgery). ...
0
votes
1answer
104 views

CSRF Security Independent From Front-End

I'm trying to figure out if I completely understand CSRF security properly. Based on: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html In all ...
0
votes
1answer
51 views

Understanding the difference between POST and PUT when securing against CSRF

Several of my Spring Security based projects expose a RESTful API that support the full range of HTTP verbs: GET, POST, PUT, PATCH, DELETE, etc. For those projects only using GET and POST, everything ...
0
votes
1answer
176 views

iframe-friendly CSRF protection

In general, CSRF protection means this: "compare <input type=hidden> with a value in user's session" (or sometimes - user cookie). Now, suppose I want my app/website to be iframe ...
0
votes
1answer
36 views

In what ways site administrators can detect incoming CSRF attacks?

In what ways site administrators can detect incoming CSRF attacks? Is it possible or not?
1
vote
0answers
104 views

What is meaning of setting port number to NULL in document.domain call?

Here (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it is mentioned The port number is checked separately by the browser. Any call to document.domain, including document....
0
votes
0answers
25 views

Doesn't seem to change _csrf token

I recently saw a very interesting post from a person describing all the steps he would take before running a scan (https://groups.google.com/g/zaproxy-users/c/SMd9OmcVWbE). It caught my attention ...
1
vote
1answer
151 views

Exploiting CSRF on DELETE Request

I was testing a site and came across a request with DELETE and I found X-CSRF: parameter was sent to ensure the doc can be deleted by a authorized person but when I removed the entire X-CSRF token and ...
0
votes
1answer
45 views

token _csrf in an url POST

I wanted to know if it was a bad thing to have a _csrf token stored in a url. I saw that in a POST request that allows me to upload a file, the _csrf token was displayed in the url. Is it sensitive to ...
0
votes
2answers
109 views

How is AMP-Same-Origin: true even remotely secure?

in the AMP Docs, the following snippet is given: If the Origin header is set: If the origin does not match one of the following values, stop and return an error response: <publisher's domain>....
2
votes
3answers
95 views

CSRF defense use case

You have an embedded device that supports HTTP based web UI over private ip address. Does it make sense to implement CSRF defense over HTTP(not HTTPS)?
4
votes
1answer
200 views

Split a JWT between payload and signature

Context: I'm looking at storage solutions for JWT tokens on a single page application. Storing the JWT in the local storage is unsafe and prone to XSS attacks. Storing the JWT in a secure / HTTP only ...
0
votes
2answers
68 views

This application is not using CSRF token but they are still able to protect sensitive actions on the site

This application is not using any CSRF token and not even cookies to identify users on their server. All they do is use a authorization header to identify users. Since an attacker doesn't know value ...
0
votes
0answers
90 views

CSRF token not sent when calling the back-end?

My system composes of NuxtJs and AdonisJs application. Adonis handles csrf tokens for us by sending: set-cookie: adonis-session=XXX; Path=/; HttpOnly set-cookie: XSRF-TOKEN=XXX; Max-Age=7200; Path=/; ...
0
votes
0answers
87 views

Authorization Header (Bearer) Vulnerability

I'd like to brainstorm/ ask regarding a possible vulnerability that I encounter recently. So recently, I was able to find an endpoint where generating an Authorization Token is possible for a user and ...
0
votes
1answer
73 views

Are client generated CSRF tokens as secure as server generated ones

I'm currently struggling with the implementation of CSRF in a web application. The application is (more or less) stateless. There is however a session that is kept in a (HttpOnly) cookie. As we use ...
5
votes
1answer
292 views

CSRF on GraphQL endpoint

I am currently doing bug bounty on a company which uses GRAPHQL for their query language and would like to check if CSRF is possible. After playing around with burpsuite I have conclude the following; ...
0
votes
2answers
63 views

What attack vectors does arbitrary JS on a user profile allow?

Consider a site for frontend devs/designers to host their portfolio apps - pages with arbitrary JS, each hosted on a user's separate profile. What attack vectors would that enable against the site? ...
0
votes
0answers
33 views

CSRF in an API that's used by both browser and apps?

I've recently learned about CSRF, I know that CSRF is for browsers, not apps, which makes sense. but I have a few questions. if an API is used by both browser (front-end) and apps (iOS/android), what ...
1
vote
2answers
160 views

Cross-Domain Request is a CSRF Attack? (CORS)

CORS is a HTTP Suite header that “relax” the SOP. One of the CORS misconfigurations is about to reflect without reg exp the “Origin” client header into “ACAO” response header. If it happens with “ACAC:...
3
votes
0answers
96 views

Should you terminate a session when an incorrect CSRF token is submitted?

According to the OWASP CSRF Prevention Guide if the server fails to ...verify the existence and validity of the token in the request compared to the token found in the user session ... then the ...
5
votes
4answers
852 views

Do I still need CSRF protection when SameSite is set to Lax?

During a security assessment I noticed that Firefox automatically set the SameSite value of a session cookie to Lax. According to the Mozilla specs, this is the case for 'modern browsers'. The ...
0
votes
1answer
37 views

Can you set a custom x-forwarded-host header in a CSRF form page?

Can you set a custom x-forwarded-host header in a CSRF form page (not xhr)?
2
votes
1answer
34 views

CSRF: GET request with POST data?

I have stumbled upon a vulnerability in a web application and was wondering if it was exploitable / worth reporting. The bug is a CSRF which would allow an attacker to send friend requests to himself ...
0
votes
1answer
140 views

CSRF Bypass using User-Agent

This is an unconventional approach of CSRF that I came across while doing the pentest for an Android mobile application. The original request is as follows (NB: Values have been edited): POST /edit/ ...
0
votes
0answers
265 views

XSS Bruteforcing results in 500 internal server error

I've been trying to trigger xss in a website with the following url https://website.com/login/error?username_or_email=xyz%40gmai.com&redirect_after_login=%2wall While trying different payloads ...
0
votes
2answers
225 views

How to prevent CSRF attacks on a REST API when using Windows Authentication

I have a Angular web app that interacts with a REST-API. Requests are authenticated with a JWT Bearer token. I now want to add support for Windows-Authentication. My current plan is to add a POST-...
0
votes
2answers
71 views

How to “trust” data that is posted from one application to other

We have a use case where a bunch of data needs to be posted from our application to a partner site where the end user takes some actions and then returns back to our site. On the return, the partner ...
1
vote
1answer
33 views

Regenerating CSFR token in AJAX requests

I would like to create a new token for each request and would like to us the following template- <script> var current_token=<?php echo $_SESSION['csrf_token']; ?> $....
2
votes
0answers
70 views

What's the point of salting Double Submit Cookie (CSRF protection)?

Django web framework uses the Double Submit Cookie pattern for CSRF protection. (The CSRF token is sent in a cookie and also in a hidden form field. Incoming requests are checked for a match between ...

1
2 3 4 5
13