120 votes
Accepted

Do I need CSRF token if I'm using Bearer JWT?

This is relevant but doesn't necessarily answer 100% of your question: https://security.stackexchange.com/a/166798/149676 The short of it is that as long as authentication isn't automatic (typically ...
Conor Mancone's user avatar
48 votes

Do I need CSRF token if I'm using Bearer JWT?

Generally, CSRF happens when a browser automatically adds headers (i.e: Session ID within a Cookie), and then made the session authenticated. Bearer tokens, or other HTTP header based tokens that ...
ndrix's user avatar
  • 3,306
24 votes

Do I need CSRF token if I'm using Bearer JWT?

Previous answers are rock solid. I'll jump in here to provide a more context and little caveat. There are lots of ways to using JWT; session management is one of them. Although it presents a few ...
Daniel Szpisjak's user avatar
5 votes
Accepted

Use javascript variable instead of session cookie

The primary security reason to avoid cookies would be to prevent CSRF attacks, which is a valid goal. Cookies were not well-thought-out from a security standpoint. On the other hand, there are well-...
CBHacking's user avatar
  • 48.4k
5 votes

JavaScript resource files are available without authentication - is this a security risk?

So I'm guessing the drive of your question here isn't whether the JavaScript files are obfuscated or not but rather whether they're accessible pre-authentication? If that's the case then I'd say it ...
Rory McCune's user avatar
  • 62.3k
5 votes
Accepted

How to pentest an AngularJS based SPA (Single Page Application)

Thanks atdre for the opening. On this note, pentesting JavaScript applications has become very complex. Newer web architectures have essentially become containers. Now some would argue on the term(s) ...
deijmaster's user avatar
5 votes
Accepted

How to properly invalidate JWT tokens and sessions in this use case?

You can't rely on the client code General rule of thumb: once you send code down to the client to run on the user's machine, it's not your code anymore. The only security you can count on is security ...
Mike Ounsworth's user avatar
4 votes

High security application in Angular - a bad idea?

The browser should be trusted with the user's data in any case. Whether you use a single-page app or a plain HTML page, you are toast if the browser is compromised. Single-page apps do not change ...
André Borie's user avatar
  • 12.8k
4 votes

How to pentest an AngularJS based SPA (Single Page Application)

Used to teach app pentest classes for a Fortune 20 appsec vendor to Fortune 100 clients. Years ago the state-of-the art for these types of assessments was the OWASP Ajax Crawling Tool where one had to ...
atdre's user avatar
  • 19.1k
4 votes
Accepted

Vulnerability in popular Javascript Framework (Angularjs)

Angular users: Stop Saving UNSANITIZED User Input. I have mixed feelings about the answer to my own question. As of Angular version 1.6, the Angular team has decided to remove the sandbox altogether....
ialexander's user avatar
4 votes

How to get client MAC address using Angular JS?

You cannot get the MAC address from the machine where the browser is running on by executing Javascript (and thus also Angular.js) inside the browser. Access to this information is restricted due to ...
Steffen Ullrich's user avatar
4 votes

Angular application for PCI-DSS certification

Yes, you can use Angular for a PCI certified/compliant application. I've done work for numerous level 1 PCI certified companies that use it. However, there are some different security concerns than a ...
pumpkinthehead's user avatar
3 votes

Do I need CSRF token if I'm using Bearer JWT?

I feel that it's important to highlight something regarding Single Page Applications (or requests from any frontend in general) that may make CSRF protections useless. I thought at first it may be a ...
Cyril Duchon-Doris's user avatar
3 votes
Accepted

Is inserting url parameters directly into the page safe in angular 2+?

As stated on angular's security page, interpolated content is always escaped. Unless the application explicitly marks the content as trusted using the DomSanitizer or there is a vulnerability in ...
user2313067's user avatar
3 votes

Get MAC address of client using PHP, Angular js, jQuery/JavaScript

You don't understand what you are doing. All PHP code (and also the backtick/exec/system commands) is executed on the server. There is no portable/reliable way to get the MAC address. Maybe a browser ...
filo's user avatar
  • 293
3 votes

What is best way to pentest an AngularJS web app with a REST backend?

For Angular.JS, there is a very handy tool Batarang Chrome Extension in the Chrome Extension Store: https://chrome.google.com/webstore/detail/angularjs-batarang/ighdmehidhipcmcojjgiloacoafjmpfk For ...
Michal Koczwara's user avatar
3 votes

Is there any point in using 'strict-dynamic' in an AngularJS 1.x application?

There is a bit of a fundamental security issue here based on the fact that an attacker can inject an Angular expression. The Angular project itself has actually stated that the sandbox is not ...
Phil Ames's user avatar
  • 111
3 votes

How secure is keeping a token in angular for future requests to a Laravel API?

Considering that you appear to only Base 64 encode the email, it's easily bypassed. Don't try to reinvent the wheel, especially for security. Use a well known authentication library. After a user ...
Nathan's user avatar
  • 842
3 votes
Accepted

Cookie-to-header token CSRF protection

The issue your vuln reporter is highlighting is the standard weakness of cookie-based CSRF protection. There are ways to plant cookies on a site - in particular, if the site doesn't use HTTP Strict ...
CBHacking's user avatar
  • 48.4k
3 votes

Is JSON vulnerability still possible?

JSON Hijacking is pretty much dead - it's been patched in all major browsers for years. My colleague did some research into this in 2016 but all the bugs mentioned are now patched: https://portswigger....
albinowax's user avatar
  • 121
2 votes
Accepted

How secure is keeping a token in angular for future requests to a Laravel API?

The difference with your token (base64 encoded email address) and a JWT is that for a JWT it is much harder to create a token for another user. With your token, I can easily encode any other email ...
Sjoerd's user avatar
  • 30.7k
2 votes

How secure is Angular?

It sounds like you're mixing scopes a bit. Angular is a front-end technology, and while you can escape HTML to prevent XSS attacks, any basic templating language can handle that. When you think about ...
Leah Sapan's user avatar
2 votes
Accepted

I discovered a Client Side Template Injection (CSTI), and after?

Try to get account takover or user data manipulation. This will be a very dangerous subject. Good form rules tell us not to be destructive. Just describe vulnerability to security team and list ...
Mesky's user avatar
  • 55
2 votes
Accepted

Cookie-to-header token CSRF protection - is it necessary to verify cookie value?

For browsers specifically, unless your CORS configuration is totally broken (configured to send pre-flight responses that allow untrusted sites to set the X-Xsrf-Token header, and also return Access-...
CBHacking's user avatar
  • 48.4k
2 votes
Accepted

Exploit user controllable C# code in webapp

...Total system compromise? "Arbitrary code execution" on a server - typically abbreviated "RCE" for "Remote Code Execution" - is generally considered to mean, in essence,...
CBHacking's user avatar
  • 48.4k
1 vote

Angular application for PCI-DSS certification

PCI DSS doesn't care about your framework, it cares about how you handle credit card details. It spans across your front and backend services. If you're not familiar with PCI-DSS the most cost ...
Lucas Kauffman's user avatar
1 vote

Use javascript variable instead of session cookie

Your question is predicated on several flawed assumptions. throwing away the cookie technology and the deadful "this site uses cookes to store etc." message I don't know what jurisdiction you are ...
symcbean's user avatar
  • 18.6k
1 vote
Accepted

AngularJS Sanitize function vs. server-side output encoding

tl;dr: Encoding should be done at the time the data is being used in context - when the code is composing HTML, javascript, etc from untrusted data - that's true whether you are composing on the ...
Egret's user avatar
  • 446

Only top scored, non community-wiki answers of a minimum length are eligible