Questions tagged [csrf]

a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

Filter by
Sorted by
Tagged with
70
votes
5answers
87k views

CSRF protection with custom headers (and without validating token)

For a REST-api it seems that it is sufficient to check the presence of a custom header to protect against CSRF attacks, e.g. client sends "X-Requested-By: whatever" and the server checks the ...
98
votes
8answers
85k views

Why refresh CSRF token per form request?

In many tutorials and guides I see that a CSRF token should be refreshed per request. My question is why do I have to do this? Isn't a single CSRF token per session much easier than generating one per ...
18
votes
2answers
14k views

Double Submit Cookies vulnerabilities

Is the Double Submit Cookies mechanism vulnerable anything other than XSS and sub-domain attacks? All CSRF protection mechanisms are vulnerable to XSS, so that's nothing new. I'm just wondering if I ...
35
votes
4answers
27k views

How to protect against login CSRF?

http://seclab.stanford.edu/websec/csrf/csrf.pdf points out that most CSRF protection mechanisms fail to protect login forms. As https://stackoverflow.com/a/15350123/14731 explains: The ...
161
votes
7answers
87k views

Should I use CSRF protection on Rest API endpoints?

Quick note: this is not a duplicate of CSRF protection with custom headers (and without validating token) despite some overlap. That post discusses how to perform CSRF protection on Rest endpoints ...
51
votes
2answers
86k views

Why is the Access-Control-Allow-Origin header necessary?

I understand the purpose of the Access-Control-Allow-Credentials header, but can't see what problem the Access-Control-Allow-Origin header solves. More precisely, it's easy to see how, if cross-...
11
votes
3answers
10k views

How does CSRF correlate with Same Origin Policy

I'm trying to understand what roles do CSRF and same origin play in the grand scheme of things. With CSRF, I'm able to pretty much do anything on other websites on clients by making requests.Same ...
14
votes
3answers
13k views

Is checking the Referer and Origin headers enough to prevent CSRF, provided that requests with neither are rejected?

Is it possible to prevent CSRF by checking the Origin and Referer headers? Is this adequate, provided that requests with neither are blocked?
29
votes
5answers
21k views

Should login and logout action have CSRF protection?

I am making a web application in Django which generates and includes CSRF tokens for sessions (a Django session can be anonymous or a registered user). Should I keep CSRF protection to the controllers ...
34
votes
5answers
40k views

What is the correct way to implement anti-CSRF form tokens?

I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet. I've created tokens as a md5 of username, form info and a salt and stored it ...
7
votes
1answer
2k views

Why CSRF's JS can't read token by GETting html

1) User is logged in bank.com in one tab, where everything is secured by CSRF tokens. Then he opens evil.com in another tab. 2) Javascript in evil.com might try to make a POST request to bank.com/...
32
votes
2answers
11k views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
15
votes
2answers
20k views

Does ASP.NET Viewstate implicitly prevent CSRF attacks? What does this mean for MVC?

If an encrypted ASP.NET Viewstate is submitted with every form, and control POST, does that mean that ASP.NET is less vulnerable to CSRF than other solutions with this? What is the extent and ...
19
votes
3answers
6k views

Why is the synchronizer token pattern preferred over the origin header check to prevent CSRF

I am well aware of the concept of CSRF, and I think I am also aware of the possible protection possibilities, as described by OWASP. However, I'm not sure why the synchronizer pattern seems to be ...
82
votes
2answers
40k views

Should I use AntiForgeryToken in all forms, even login and registration?

I'm running a rather large site with thousands of visits every day, and a rather large userbase. Since I started migrating to MVC 3, I've been putting the AntiForgeryToken in a number of forms, that ...
66
votes
4answers
49k views

Do I need CSRF token if I'm using Bearer JWT?

Context: Angular site is hosted on S3 behind CloudFront, separate from Express server that is used as API and almost all requests are XMLHttpRequests. All requests are sent without cookies (...
15
votes
3answers
22k views

CSRF with JSON POST when Content-Type must be application/json

I am testing web application for which business actions are done by sending JSON requests like for example: POST /dataRequest HTTP/1.1 Host: test.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; ...
5
votes
3answers
1k views

Can CSRF attacks steal log in information?

Sorry very new to security. If a user is logged into a secure site (credentials are SSN and a password) and then is victim to a CSRF, can their log in information be at risk?
5
votes
2answers
2k views

CSRF protection for unauthenticated requests, actions, searches or comments?

I have gone through the example of CSRF funds transfer from a bank where the user is logged in. Similarly I have looked at CSRF in case of email updating. I think I understood it but I am not quite ...
46
votes
3answers
29k views

OAuth2 Cross Site Request Forgery, and state parameter

http://tools.ietf.org/html/draft-ietf-oauth-v2-30#section-10.12 says: The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the redirection URI ...
33
votes
2answers
35k views

CSRF with JSON POST

I am playing around with a test application which accepts JSON requests and response is also JSON. I am trying to do a CSRF for a transaction which accepts only JSON data with POST method in request. ...
65
votes
7answers
28k views

Does a CSRF cookie need to be HttpOnly?

We recently were handed a security report containing the: Cookie(s) without HttpOnly flag set vulnerability, which we apparently had in one of our internal applications. The applied fix was as ...
9
votes
2answers
6k views

Preventing CSRF attacks against WebSocket communications

I have read the thread about CSRF attacks in websockets (Do WebSocket-powered web apps (e.g. "comet" apps) have to worry about CSRF?) and also some more material regarding websocket security,...
8
votes
4answers
5k views

Can anti-CSRF token prevent bruteforce attack?

I am not much experienced with brute force attacks but I was wondering Suppose, you have a website www.example.com and you want to do brute force attack on that login form but that login form is ...
7
votes
2answers
3k views

Is one CSRF token per session is adequate with HTTPS?

Ours is a Ajax heavy application with concurrent Ajax requests. Generating unique tokens with each request or expire and creation of new tokens after a certain interval could get tricky with multiple ...
7
votes
3answers
3k views

Ajax and CSRF protection

Without going into too much details I have a site which is 100% Ajax. All requests to the site (both GET and POST) are done via Ajax. Now I have to implement CSRF protection, and all the solutions I ...
6
votes
3answers
825 views

Are CSRF Attacks Really Blind

I'm new to CSRF attacks but don't see how they are always blind. Let's say we are dealing with a site where the asset we need to protect is the HTTP response. Something like one's medical history. ...
9
votes
2answers
2k views

How does sending referrer HTTP headers protect against CSRF attacks?

How does sending referrer HTTP headers protect against CSRF attacks? I tried logging into an HTTPS site with Firefox's network.http.sendRefererHeader set to 0 (i.e., completely disabled, as a measure ...
2
votes
1answer
4k views

Exploiting CSRF PUT request

If the application uses RESTful communication, does it need to have CSRF protection for PUT and DELETE requests? As per my understanding its not possible to trigger a PUT request using JavaScript and ...
53
votes
1answer
24k views

Is Django's built-in security enough?

I have learned that Django provides built-in protection against the three main types of web app attacks (SQL injection, XSS and CSRF), which is really awesome. Yet I have spoken to a few Django ...
45
votes
6answers
27k views

Is CORS helping in anyway against Cross-Site Forgery?

I've been reading in the last couple of days about CORS and in a lot of places it's mentioned as it is a "Security" feature to help the world from cross domain forgery. I still don't see the benefit ...
27
votes
1answer
38k views

Difference between XSS and CSRF? [closed]

I know about cross-site scripting and cross-site request forgery. I want to know if there is any similarity between them?
18
votes
4answers
20k views

Is a JWT usable as a CSRF token?

I'm in need of a CSRF token, for a certain application that submits a form with POST. Ideally, I'd like to not make a DB call for each submission, to avoid storage and DB traffic & latency. To ...
45
votes
3answers
10k views

Why don't browsers block cross-site POSTs by default?

Same-origin policy (SOP) makes browsers block scripting from one origin to mess with another, unless explicitly being told not to do so. But cross-site POSTs are still allowed, creating the vector for ...
15
votes
2answers
8k views

How to do Ajax securely?

This question is inspired by this security question https://security.stackexchange.com/questions/1707 What are the threats in using Ajax? (Please note I am talking about security threats, not ...
21
votes
1answer
28k views

How does a CSRF token prevent an attack, and how can I safely use/avoid it for my JSON API?

I'm trying to make an iOS app communicate with a Ruby on Rails website using JSON. While trying to post a login to create a user session, I discovered I was missing a CSRF token. I had no idea what ...
22
votes
3answers
10k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
13
votes
5answers
9k views

CSRF protection with Session Id

To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent? The server would then just ...
9
votes
3answers
17k views

GET and POST request vulnerable to CSRF attack?

Are both GET and POST request vulnerable to CSRF? Should we use PUT instead?
13
votes
2answers
6k views

Why are cookies considered more secure against XSS?

This article discusses storing session tokens in a cookie vs in localStorage: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/ The article states: Cookies, when ...
21
votes
3answers
2k views

Why should double submit CSRF tokens be cryptographically strong random numbers?

I was just going through the OWASP's Cheat Sheet for CSRF Prevention. Regarding the double submit cookies method, it says: the site should generate a (cryptographically strong) pseudorandom value ...
9
votes
2answers
3k views

Are RESTful sites safe against CSRF attacks?

I am having a debate with a coworker about whether our site is vulnerable to CSRF attacks. He is saying that since we are using RESTful AJAX requests for everything that CSRF is not possible. Say a ...
10
votes
2answers
6k views

Why does Double Submit Cookies require a separate cookie?

According to https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Double_Submit_Cookies: When a user authenticates to a site, the site should generate a (...
6
votes
2answers
2k views

Do WebSocket-powered web apps (e.g. “comet” apps) have to worry about CSRF?

The standard advice for HTTP applications wanting to prevent Cross Site Request Forgery is to include a random token on each state-changing request (usually POST) which is verified by the server ...
6
votes
7answers
6k views

Should I prevent sending of GET requests for urls that are normally operated with POST request?

There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
5
votes
2answers
969 views

Is there any effective server-side prevention technique against PHP-aided CSRF?

I'm gonna start by saying it: I'm merely a cybersecurity enthusiast, not an expert. Thus, I'm gonna state what I think I know so far, please feel free to correct me at any time. Through my readings, ...
4
votes
1answer
4k views

How to fix open redirect vulnerability?

In redir.php: header("Location: {$_GET['addr']}"); For fixing open redirect vulnerability i can think of several ways: 1- (Side effect of) Using a security token (anti-csrf token): if(!isset($...
6
votes
2answers
3k views

With BREACH attack, is session-based CSRF token still secure?

This is something I haven't been able wrap my head around, if BREACH allow leaking of information, do we have to mask or generate CSRF token in a time-based or per-request fashion to make it more ...
3
votes
1answer
3k views

Is JWT in cookies with any CSRF solution just as vulnerable to XSS as JWT in localStorage?

I've read that JWT tokens shouldn't be stored in localStroage because XSS attacks can read them. The proposed solution is to store JWT tokens in HTTPOnly cookies and use anti-CSRF w/ double-submit ...
3
votes
4answers
3k views

Can a CSRF CAPTCHA be defeated?

One defense that developers use to protect against a CSRF attack is to implement a CAPTCHA in critical steps. A CAPTCHA ensures that a human is at the keyboard approving the activity. But I've ...