Hot answers tagged

292 votes
Accepted

Should I use CSRF protection on Rest API endpoints?

I wasn't originally aiming for a self-answer, but after more reading I've come up with what I believe to be a comprehensive answer that also explains why some might still be interested in CSRF ...
Conor Mancone's user avatar
120 votes
Accepted

Do I need CSRF token if I'm using Bearer JWT?

This is relevant but doesn't necessarily answer 100% of your question: https://security.stackexchange.com/a/166798/149676 The short of it is that as long as authentication isn't automatic (typically ...
Conor Mancone's user avatar
97 votes
Accepted

Does a CSRF cookie need to be HttpOnly?

As joe says, there is no real security benefit to this. It is pure security theater. I'd like to highlight this from the documentation: If you enable this and need to send the value of the CSRF ...
Anders's user avatar
  • 65.6k
74 votes
Accepted

For SameSite cookie with subdomains what are considered the same site?

The 'Site' in SameSite refers to a the combination of second level domain mysite.com and top level domain mysite.com. This means that a requests from login.mysite.com to cdn.mysite.com would be ...
ilikebeets's user avatar
  • 2,876
66 votes
Accepted

Difference between XSS and CSRF?

In a cross-site request forgery attack, the attacker tries to force/trick you into making a request which you did not intend. This could be sending you a link that makes you involuntarily change your ...
Arminius's user avatar
  • 44.7k
66 votes
Accepted

Why don't browsers block cross-site POSTs by default?

In theory your suggestion is perfectly reasonable. If browsers blocked all cross origin POST requests by default, and it required a CORS policy to unlock them, a lot of all the CSRF vulnerabilities ...
Anders's user avatar
  • 65.6k
60 votes
Accepted

Should I use CSRF protection for GET requests?

CSRF protection is only needed for state-changing operations because of the same-origin policy. This policy states that: a web browser permits scripts contained in a first web page to access data ...
Neil Smithline's user avatar
60 votes
Accepted

Will same-site cookies be sufficient protection against CSRF and XSS?

First, a definition from Chrome: Same-site cookies (née "First-Party-Only" (née "First-Party")) allow servers to mitigate the risk of CSRF and information leakage attacks by ...
Anders's user avatar
  • 65.6k
48 votes

Do I need CSRF token if I'm using Bearer JWT?

Generally, CSRF happens when a browser automatically adds headers (i.e: Session ID within a Cookie), and then made the session authenticated. Bearer tokens, or other HTTP header based tokens that ...
ndrix's user avatar
  • 3,306
46 votes

Pentest Results: Questionable CSRF Attack

This does not seem to be a CSRF vulnerability. If an attacker needs to know a CSRF Token, then it's not an attack. And your approach to CSRf does seem to be correct. Issues which leak the CSRF ...
tim's user avatar
  • 29.6k
40 votes
Accepted

HTML login form without a CSRF protection

This is called "Login CSRF" and is indeed a real problem that you should address. While an attacker couldn't fool a victim to log in to their own account since the attacker doesn't know the ...
Anders's user avatar
  • 65.6k
39 votes

How does CSRF correlate with Same Origin Policy

Let us start by defining the term "origin". The origin of a page is decided by three unique factors: hostname, protocol and port number. For example, http://test.com and https://test.com have ...
Shurmajee's user avatar
  • 7,447
34 votes
Accepted

Setting Same-Site cookie attribute to Lax

Is setting Same-Site attribute of a cookie to lax the same as not setting the Same-Site attribute? In Google Chrome < 76 – no. Setting SameSite=lax is safer than omitting the attribute. (But if ...
Arminius's user avatar
  • 44.7k
33 votes
Accepted

Is checking the Referer and Origin headers enough to prevent CSRF, provided that requests with neither are rejected?

Expanding on the answers of @Sjoerd and @lindon. Origin vs Referer vs CSRF token Most likely, the reason OWASP recommends also using a CSRF token, is that at the time when this recommendation was ...
Tobias Bergkvist's user avatar
30 votes

Should I use CSRF protection for GET requests?

Ordinarily safe methods do not have to be protected against CSRF because they do not make changes to the application, and even if they're returning sensitive information this will be protected by the ...
SilverlightFox's user avatar
29 votes

Is a JWT usable as a CSRF token?

TL;DR A JWT, if used without Cookies, negates the need for a CSRF token - BUT! by storing JWT in session/localStorage, your expose your JWT and user's identity if your site has an XSS vulnerability (...
Scott Jungwirth's user avatar
27 votes
Accepted

Why is CSRF protection only applicable to web services with browser clients?

It comes down to the fact that CSRF is an attack against browsers, so if your service is exclusively used by non-browsers there's no point in using anti-CSRF defences, which can be expensive so may be ...
Douglas Leeder's user avatar
24 votes

Do I need CSRF token if I'm using Bearer JWT?

Previous answers are rock solid. I'll jump in here to provide a more context and little caveat. There are lots of ways to using JWT; session management is one of them. Although it presents a few ...
Daniel Szpisjak's user avatar
24 votes

Why don't browsers block cross-site POSTs by default?

The problem is not the request method: CSRF could also be done with a GET request. The problem is instead that authentication information like (session) cookies or the Authorization header are ...
Steffen Ullrich's user avatar
23 votes
Accepted

Is the core idea behind CSRF protection that the hacker doesn't know the token value?

Your understanding is correct. Background The simplest way to think of a CSRF attack is that your browser has two tabs open - Tab A: www.mybank.com and Tab B: www.attacker.com. (As @Alex points ...
Mike Ounsworth's user avatar
20 votes
Accepted

How do I safely host third-party Javascript code in an iframe?

If the content you're embedding will contain untrusted scripts, it must either be loaded in an iframe from an untrusted domain, or be loaded from srcdoc in a sandboxed iframe with the allow-same-...
Ajedi32's user avatar
  • 4,743
18 votes

Does a CSRF cookie need to be HttpOnly?

I think the main point of confusion here is that the Django docs are specifically talking about the CSRF use case for a cookie. In order to understand why the httpOnly flag adds no value in preventing ...
colllin's user avatar
  • 281
18 votes
Accepted

Do I still need CSRF protection when SameSite is set to Lax?

The current answer shows that we currently should not. But at what point in the future can we start to rely on this? Comparing the data from caniuse and the MDN support tables. You can observe that ...
anthonyryan1's user avatar
18 votes
Accepted

Is a backend API server vulnerable to CSRF?

Our application is a pure backend server. Serving JSON APIs to the users. Users will be calling these APIs from their backend in 99.99% of the cases. ... It does not matter what the API is serving or ...
Steffen Ullrich's user avatar
17 votes
Accepted

Current status of SameSite cookie

SameSite cookies are here to stay. They were available for a long time in Chrome (since v51) and more recently got implemented in Firefox. Making cookies samesite protect against a whole range of ...
Sjoerd's user avatar
  • 30.4k
17 votes

For SameSite cookie with subdomains what are considered the same site?

Let me explain the specification. The definition of "same-site" is : A request is "same-site" if its target's URI's origin's registered domain is an exact match for the request's ...
xianshenglu's user avatar
16 votes

Securely using JWTs with CSRF protection and refresh tokens

You seem to be mixing up several different opposing technologies, and do not make it clear why you have chosen these technologies and why they control the threats you are trying to secure against. ...
SilverlightFox's user avatar
15 votes
Accepted

Is a JWT usable as a CSRF token?

There is no need to encrypt the token or to include the nonce. The key properties of a CSRF token are that it is not predictable by an attacker, and, unlike cookies, that it is not added to every ...
Neil Smithline's user avatar
14 votes

Should I use CSRF protection on Rest API endpoints?

Whether or not CSRF protection is needed is based on 2 factors: - Is the request doing a state changing action (not the same as REST API Statelessness) - State changing actions are any action that ...
an0904's user avatar
  • 303
14 votes

Does a CSRF cookie need to be HttpOnly?

That is correct. This is a false positive and the person providing this finding to you does not understand what they are doing unfortunately. Someone that understood the risks of mitm and csrf attacks ...
joe's user avatar
  • 592

Only top scored, non community-wiki answers of a minimum length are eligible