Questions tagged [csrf]

a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

Filter by
Sorted by
Tagged with
7
votes
2answers
116 views

Why does Spring Security unset and set the same Cookie in one Request?

In the CSRF implementation of Spring Security (https://github.com/spring-projects/spring-security/blob/master/web/src/main/java/org/springframework/security/web/csrf/CsrfAuthenticationStrategy.java#...
0
votes
1answer
39 views

Protecting an external authentication server against CSRF

I have a web application which uses an external authentication server for obtaining a session. When a client tries to login, the browser is making requests towards the external authentication server ...
1
vote
1answer
44 views

Is server side CORS protection enough to mitigate CSRF attacks against stateless APIs?

Assume an Angular SPA application on www.example.com that works invoking an API over that same domain www.example.com/api/... The Angular app gets a session cookie and sends it in each API call. The ...
1
vote
1answer
43 views

Why using “state” variable in OAuth 2

I am building an application that is integrated with a 3rd party service provider and uses OAuth 2 to obtain permission from other users using the service to access their account information. Based on ...
29
votes
6answers
21k views

Should login and logout action have CSRF protection?

I am making a web application in Django which generates and includes CSRF tokens for sessions (a Django session can be anonymous or a registered user). Should I keep CSRF protection to the controllers ...
5
votes
2answers
2k views

CSRF protection for unauthenticated requests, actions, searches or comments?

I have gone through the example of CSRF funds transfer from a bank where the user is logged in. Similarly I have looked at CSRF in case of email updating. I think I understood it but I am not quite ...
0
votes
0answers
25 views

Double submit with signed CSRF token, is it safe?

In this article about CSRF, it is mentioned that the "double submit" protection can be circumvented by the attacker inventing a token and setting it as a cookie (through XSS I guess). Now ...
0
votes
1answer
72 views

Detailed explanations on OWASP Zap Security scan rules

As an example, I have installed Anti-CSRF Scanning rule in ZAP proxy and scanned a POST request which does not verify the CSRF token value from the back end. Ideally, it is a CSRF vulnerability, but ...
1
vote
1answer
79 views

How do I automatically add a user login token to my csrf page?

I'm testing my own system, and I was wondering if the csrf login token I created there could be obtained from the user session. For example; <input type="hidden" name="login&#95;token" value="...
13
votes
5answers
9k views

CSRF protection with Session Id

To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent? The server would then just ...
0
votes
1answer
82 views

CSRF Security Independent From Front-End

I'm trying to figure out if I completely understand CSRF security properly. Based on: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html In all ...
0
votes
0answers
32 views

Different Ways (Testcases) to Test API (endpoints) for CSRF in Website

I have added some prevention in website for CSRF. (i.e - I have added functionality to check CSRF token / form key for controller for POST method. ) I am not sure about the ways the API can be tested ...
0
votes
0answers
47 views

Are application using custom header instead of CSRF token safe?

This application sends data to the server in JSON and checks for the content-type header, but I was able to bypass this, but it sends another custom header which is not a secret token or something ...
1
vote
0answers
18 views

Do __VIEWSTATEGENERATOR, __EVENTVALIDATION prevent CSRF? [duplicate]

I've seen __VIEWSTATEGENERATOR, __EVENTVALIDATION in every .NET website. Theirs value change, for example, at every login request. Do these fields prevent CSRF? If yes/no, why?
0
votes
2answers
69 views

How to “trust” data that is posted from one application to other

We have a use case where a bunch of data needs to be posted from our application to a partner site where the end user takes some actions and then returns back to our site. On the return, the partner ...
2
votes
1answer
73 views

Should I check Host header or ServerName for CSRF defense when serving behind proxies?

In a CSRF defense based on checking forbidden headers, should I check Origin/Referer header against the ServerName configuration directive, or is it sufficient to simply check against the HTTP Host ...
0
votes
1answer
180 views

How to bypass origin based csrf protection?

I'm trying to do some csrf attack test on a site. I found that the site protect itself from csrf by checking the http Origin header. But I guess maybe under some conditions I can bypass the ...
0
votes
0answers
50 views

It's possible to bypass CSRF protection Referer-Based by spoof the referer in browser victim ? (POST-Based)

It's possible to bypass CSRF protection Referer-Based by spoof the referer in browser victim ? (POST-Based) Hello, i try to bypass a CSRF protection Referer-Based. I know the basic knowledge to bypass ...
1
vote
1answer
172 views

Is this private network authentication system secure?

I am building an authentication system to be used within a company's private network. I do not administer this network, and I know very little about the setup, but my basic understanding is you must ...
5
votes
4answers
453 views

Do I still need CSRF protection when SameSite is set to Lax?

During a security assessment I noticed that Firefox automatically set the SameSite value of a session cookie to Lax. According to the Mozilla specs, this is the case for 'modern browsers'. The ...
12
votes
2answers
15k views

Are phone apps vulnerable to XSS or CSRF? (Webview, Phonegap, chrometab)

Is CSRF or XSS is possible on a phone... using PhoneGap, a Webview, or specifically a "Chrome Tab" or iOS equivalent. I believe in theory this is possible, and mitigation is needed, but ...
0
votes
1answer
49 views

Understanding the difference between POST and PUT when securing against CSRF

Several of my Spring Security based projects expose a RESTful API that support the full range of HTTP verbs: GET, POST, PUT, PATCH, DELETE, etc. For those projects only using GET and POST, everything ...
0
votes
0answers
22 views

Why it is _the client_ (and not _the authorization server_) who is to validate the anti-CSRF state in OAuth workflow?

The client MUST implement CSRF protection for its redirection URI. This is typically accomplished by requiring any request sent to the redirection URI endpoint to include a value that binds the ...
0
votes
1answer
155 views

Adding a static token to ZAP vulnerability scanner

I am currently trying to get the OWASP ZAP scanners working on a peculiar website. When authenticated on this website, each GET request needs a "token" (most likely a anti-CSRF token) as a parameter. ...
1
vote
0answers
46 views

How can I implement CSRF Tokens without server-side rendering/templating?

I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
0
votes
0answers
23 views

How can the CSRF happen if browsers do not allow cross-origin requests by default? [duplicate]

How can the CSRF happen if browsers do not allow cross-origin requests by default? Brief CSRF overview, which is relevant for the question. CSRF is a type of attack (i.e. cross-site request forgery). ...
0
votes
1answer
768 views

CSRF Token for Anti Automation for multiple requests

Need some inputs for the CSRF token design to prevent anti-automation. 1. When a page loads for an user session, a request is given to the server, which would fetch the CSRF token , returned as part ...
0
votes
1answer
102 views

iframe-friendly CSRF protection

In general, CSRF protection means this: "compare <input type=hidden> with a value in user's session" (or sometimes - user cookie). Now, suppose I want my app/website to be iframe ...
33
votes
2answers
7k views

HTML login form without a CSRF protection

We've recently got a vulnerability report saying that one of our HTML forms in one of the internal applications is not CSRF protected. At first, we could not immediately reproduce it manually using ...
0
votes
1answer
160 views

Application design to avoid XSS & CSRF attacks

I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
1
vote
1answer
2k views

OpenID Connect: Is storing access token in browser secure?

I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
2
votes
1answer
160 views

XSS chained with CSRF = Stored XSS?

I have recently heard that XSS + CSRF = stored XSS. I didn't think too much about it at the time, but now it's bugging me, because it doesn't make too much sense. I would say that it can stand true, ...
0
votes
1answer
34 views

In what ways site administrators can detect incoming CSRF attacks?

In what ways site administrators can detect incoming CSRF attacks? Is it possible or not?
0
votes
1answer
56 views

Check the origin header server-wide in IIS to prevent CSRF through the IIS configuration change Only

Could you please let me know how can we check the origin header server-wide in IIS to prevent CSRF through the configuration change only without adding a custom HTTP module in IIS?
0
votes
2answers
123 views

Can I rely on the CSRF cookie to check if a user is authenticated on the client-side?

I have a website that runs on example.com. The website makes AJAX calls to my backend API which sits at api.example.com. I employ a double-submit verification strategy. The backend has protected ...
9
votes
2answers
7k views

CSRF in microservice architecture

What should be proper way to implement CSRF protection in microservice architecture? Where services are stateless. To put CSRF verification on system entry? e.g. Gateway With this option I can't ...
1
vote
0answers
101 views

What is meaning of setting port number to NULL in document.domain call?

Here (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it is mentioned The port number is checked separately by the browser. Any call to document.domain, including document....
4
votes
1answer
261 views

Is it safe to create a session from an auth token?

My server is using Django Rest Framework. My mobile app logs in using token authentication. However, I also have a webview in the mobile app where I need to log in. I can't inject the auth token on ...
3
votes
1answer
158 views

Using same CSRF token after relogin

I am testing a website and observing the following behavior while intercepting and re-sending the request using postman. CSRF token is generated for each request User logs out. Generated CSRF token ...
1
vote
1answer
89 views

Exploiting CSRF on DELETE Request

I was testing a site and came across a request with DELETE and I found X-CSRF: parameter was sent to ensure the doc can be deleted by a authorized person but when I removed the entire X-CSRF token and ...
0
votes
0answers
24 views

Doesn't seem to change _csrf token

I recently saw a very interesting post from a person describing all the steps he would take before running a scan (https://groups.google.com/g/zaproxy-users/c/SMd9OmcVWbE). It caught my attention ...
18
votes
4answers
20k views

Is a JWT usable as a CSRF token?

I'm in need of a CSRF token, for a certain application that submits a form with POST. Ideally, I'd like to not make a DB call for each submission, to avoid storage and DB traffic & latency. To ...
0
votes
1answer
85 views

How is AMP-Same-Origin: true even remotely secure?

in the AMP Docs, the following snippet is given: If the Origin header is set: If the origin does not match one of the following values, stop and return an error response: <publisher's domain>....
0
votes
1answer
43 views

token _csrf in an url POST

I wanted to know if it was a bad thing to have a _csrf token stored in a url. I saw that in a POST request that allows me to upload a file, the _csrf token was displayed in the url. Is it sensitive to ...
2
votes
3answers
92 views

CSRF defense use case

You have an embedded device that supports HTTP based web UI over private ip address. Does it make sense to implement CSRF defense over HTTP(not HTTPS)?
4
votes
1answer
159 views

Split a JWT between payload and signature

Context: I'm looking at storage solutions for JWT tokens on a single page application. Storing the JWT in the local storage is unsafe and prone to XSS attacks. Storing the JWT in a secure / HTTP only ...
0
votes
1answer
2k views

Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?

The Python code below should grab a CSRF token cookie from Instagram.com, but I get an error message when running the program through any sort of HTTPS or SOCKS5 proxy, informing me that the CSRF ...
1
vote
2answers
368 views

How can the Cookie-to-header-token CSRF protection technique be thwarted by permissive CORS origin header?

According to https://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-header_token The protection provided by this technique can be thwarted if the target website disables its same-...
0
votes
2answers
68 views

This application is not using CSRF token but they are still able to protect sensitive actions on the site

This application is not using any CSRF token and not even cookies to identify users on their server. All they do is use a authorization header to identify users. Since an attacker doesn't know value ...
161
votes
7answers
87k views

Should I use CSRF protection on Rest API endpoints?

Quick note: this is not a duplicate of CSRF protection with custom headers (and without validating token) despite some overlap. That post discusses how to perform CSRF protection on Rest endpoints ...

1
2 3 4 5
13