254
votes
Accepted
Should I use CSRF protection on Rest API endpoints?
I wasn't originally aiming for a self-answer, but after more reading I've come up with what I believe to be a comprehensive answer that also explains why some might still be interested in CSRF ...
- 29.7k
93
votes
Accepted
Do I need CSRF token if I'm using Bearer JWT?
This is relevant but doesn't necessarily answer 100% of your question:
https://security.stackexchange.com/a/166798/149676
The short of it is that as long as authentication isn't automatic (typically ...
- 29.7k
89
votes
Accepted
Does a CSRF cookie need to be HttpOnly?
As joe says, there is no real security benefit to this. It is pure security theater. I'd like to highlight this from the documentation:
If you enable this and need to send the value of the CSRF ...
- 64.2k
76
votes
Is CORS helping in anyway against Cross-Site Forgery?
I'll start my answer by saying that many people misunderstand the Same Origin Policy and what CORS brings to the table.
Some of the up-voted answers already here are stating that the Same Origin ...
- 33.2k
66
votes
Accepted
Difference between XSS and CSRF?
In a cross-site request forgery attack, the attacker tries to force/trick you into making a request which you did not intend. This could be sending you a link that makes you involuntarily change your ...
- 43.6k
62
votes
Accepted
Why don't browsers block cross-site POSTs by default?
In theory your suggestion is perfectly reasonable. If browsers blocked all cross origin POST requests by default, and it required a CORS policy to unlock them, a lot of all the CSRF vulnerabilities ...
- 64.2k
53
votes
Accepted
Should I use CSRF protection for GET requests?
CSRF protection is only needed for state-changing operations because of the same-origin policy. This policy states that:
a web browser permits scripts contained in a first web page to access data ...
- 14.6k
53
votes
Accepted
Will same-site cookies be sufficient protection against CSRF and XSS?
First, a definition from Chrome:
Same-site cookies (née "First-Party-Only" (née "First-Party")) allow servers to mitigate the risk of CSRF and information leakage attacks by ...
- 64.2k
53
votes
Accepted
For SameSite cookie with subdomains what are considered the same site?
The 'Site' in SameSite refers to a the combination of second level domain mysite.com and top level domain mysite.com.
This means that a requests from login.mysite.com to cdn.mysite.com
would be ...
- 2,616
50
votes
OAuth2 Cross Site Request Forgery, and state parameter
Let's walk through how this attack works.
The Attack
I visit some client's website and start the process of authorizing that client to access some service provider using OAuth
The client asks the ...
- 601
46
votes
Pentest Results: Questionable CSRF Attack
This does not seem to be a CSRF vulnerability.
If an attacker needs to know a CSRF Token, then it's not an attack. And your approach to CSRf does seem to be correct.
Issues which leak the CSRF ...
- 29k
42
votes
CSRF protection with custom headers (and without validating token)
TL;DR - Checking the existence of a non-standard header like "X-Requested-By" should be sufficient to guard against CSRF attacks without checking the value of the header.
Non-standard headers cannot ...
- 529
40
votes
Accepted
HTML login form without a CSRF protection
This is called "Login CSRF" and is indeed a real problem that you should address.
While an attacker couldn't fool a victim to log in to their own account since the attacker doesn't know the ...
- 64.2k
36
votes
Do I need CSRF token if I'm using Bearer JWT?
Generally, CSRF happens when a browser automatically adds headers (i.e: Session ID within a Cookie), and then made the session authenticated. Bearer tokens, or other HTTP header based tokens that ...
- 3,146
35
votes
How does CSRF correlate with Same Origin Policy
Let us start by defining the term "origin". The origin of a page is decided by three unique factors: hostname, protocol and port number. For example, http://test.com and https://test.com have ...
- 7,275
34
votes
Accepted
Should login and logout action have CSRF protection?
Possibly you should protect against Login CSRF. Without this protection an attacker can effectively reverse a CSRF attack. Rather than the victim being logged in to their own account and the attacker ...
- 33.2k
34
votes
Accepted
Setting Same-Site cookie attribute to Lax
Is setting Same-Site attribute of a cookie to lax the same as not setting the Same-Site attribute?
In Google Chrome < 76 – no. Setting SameSite=lax is safer than omitting the attribute. (But if ...
- 43.6k
27
votes
Is a JWT usable as a CSRF token?
TL;DR
A JWT, if used without Cookies, negates the need for a CSRF token - BUT! by storing JWT in session/localStorage, your expose your JWT and user's identity if your site has an XSS vulnerability (...
- 371
26
votes
Should I use CSRF protection for GET requests?
Ordinarily safe methods do not have to be protected against CSRF because they do not make changes to the application, and even if they're returning sensitive information this will be protected by the ...
- 33.2k
25
votes
Accepted
How to protect against login CSRF?
With anonymous cookies
If you are happy to generate secure tokens which are set as anonymous users' cookies, but not to store them server side then you could simply double submit cookies.
e.g. ...
- 33.2k
25
votes
Accepted
Why is CSRF protection only applicable to web services with browser clients?
It comes down to the fact that CSRF is an attack against browsers, so if your service is exclusively used by non-browsers there's no point in using anti-CSRF defences, which can be expensive so may be ...
- 1,949
23
votes
Accepted
Is checking the Referer and Origin headers enough to prevent CSRF, provided that requests with neither are rejected?
Expanding on the answers of @Sjoerd and @lindon.
Origin vs Referer vs CSRF token
Most likely, the reason OWASP recommends also using a CSRF token, is that at the time when this recommendation was ...
- 466
23
votes
Why don't browsers block cross-site POSTs by default?
The problem is not the request method: CSRF could also be done with a GET request. The problem is instead that authentication information like (session) cookies or the Authorization header are ...
- 181k
23
votes
Accepted
Is the core idea behind CSRF protection that the hacker doesn't know the token value?
Your understanding is correct.
Background
The simplest way to think of a CSRF attack is that your browser has two tabs open - Tab A: www.mybank.com and Tab B: www.attacker.com.
(As @Alex points ...
- 57.1k
22
votes
Accepted
Double Submit Cookies vulnerabilities
According to a paper published in Blackhat 2013, it isn't enough for you to implement Double-Submit Cookies in its own sub-domain (e.g. secure.host.com). You really must control all sub-domains:
2.1....
- 2,149
20
votes
Why does an anti-forgery token need so many bits?
Your question makes an assumption that should not be made in the field:
wouldn't you be able to detect and lock them out after a few attempts
Yes, in a good working environment there should be a ...
- 1,344
20
votes
Accepted
How do I safely host third-party Javascript code in an iframe?
If the content you're embedding will contain untrusted scripts, it must either be loaded in an iframe from an untrusted domain, or be loaded from srcdoc in a sandboxed iframe with the allow-same-...
- 4,567
19
votes
Accepted
how can we find the CSRF vulnerability in a website?
I would probably take the following steps:
Identify a URL on your site where a CSRF attack could have a negative effect on your site. For this example lets say a GET request to http://mysite.com/...
- 8,145
18
votes
Do I need CSRF token if I'm using Bearer JWT?
Previous answers are rock solid. I'll jump in here to provide a more context and little caveat. There are lots of ways to using JWT; session management is one of them. Although it presents a few ...
- 1,745
Only top scored, non community-wiki answers of a minimum length are eligible