Hot answers tagged

254 votes
Accepted

Should I use CSRF protection on Rest API endpoints?

I wasn't originally aiming for a self-answer, but after more reading I've come up with what I believe to be a comprehensive answer that also explains why some might still be interested in CSRF ...
user avatar
93 votes
Accepted

Do I need CSRF token if I'm using Bearer JWT?

This is relevant but doesn't necessarily answer 100% of your question: https://security.stackexchange.com/a/166798/149676 The short of it is that as long as authentication isn't automatic (typically ...
user avatar
89 votes
Accepted

Does a CSRF cookie need to be HttpOnly?

As joe says, there is no real security benefit to this. It is pure security theater. I'd like to highlight this from the documentation: If you enable this and need to send the value of the CSRF ...
user avatar
  • 64.2k
76 votes

Is CORS helping in anyway against Cross-Site Forgery?

I'll start my answer by saying that many people misunderstand the Same Origin Policy and what CORS brings to the table. Some of the up-voted answers already here are stating that the Same Origin ...
user avatar
66 votes
Accepted

Difference between XSS and CSRF?

In a cross-site request forgery attack, the attacker tries to force/trick you into making a request which you did not intend. This could be sending you a link that makes you involuntarily change your ...
user avatar
  • 43.6k
62 votes
Accepted

Why don't browsers block cross-site POSTs by default?

In theory your suggestion is perfectly reasonable. If browsers blocked all cross origin POST requests by default, and it required a CORS policy to unlock them, a lot of all the CSRF vulnerabilities ...
user avatar
  • 64.2k
53 votes
Accepted

Should I use CSRF protection for GET requests?

CSRF protection is only needed for state-changing operations because of the same-origin policy. This policy states that: a web browser permits scripts contained in a first web page to access data ...
user avatar
53 votes
Accepted

Will same-site cookies be sufficient protection against CSRF and XSS?

First, a definition from Chrome: Same-site cookies (née "First-Party-Only" (née "First-Party")) allow servers to mitigate the risk of CSRF and information leakage attacks by ...
user avatar
  • 64.2k
53 votes
Accepted

For SameSite cookie with subdomains what are considered the same site?

The 'Site' in SameSite refers to a the combination of second level domain mysite.com and top level domain mysite.com. This means that a requests from login.mysite.com to cdn.mysite.com would be ...
user avatar
  • 2,616
50 votes

OAuth2 Cross Site Request Forgery, and state parameter

Let's walk through how this attack works. The Attack I visit some client's website and start the process of authorizing that client to access some service provider using OAuth The client asks the ...
user avatar
  • 601
46 votes

Pentest Results: Questionable CSRF Attack

This does not seem to be a CSRF vulnerability. If an attacker needs to know a CSRF Token, then it's not an attack. And your approach to CSRf does seem to be correct. Issues which leak the CSRF ...
user avatar
  • 29k
42 votes

CSRF protection with custom headers (and without validating token)

TL;DR - Checking the existence of a non-standard header like "X-Requested-By" should be sufficient to guard against CSRF attacks without checking the value of the header. Non-standard headers cannot ...
user avatar
  • 529
40 votes
Accepted

HTML login form without a CSRF protection

This is called "Login CSRF" and is indeed a real problem that you should address. While an attacker couldn't fool a victim to log in to their own account since the attacker doesn't know the ...
user avatar
  • 64.2k
36 votes

Do I need CSRF token if I'm using Bearer JWT?

Generally, CSRF happens when a browser automatically adds headers (i.e: Session ID within a Cookie), and then made the session authenticated. Bearer tokens, or other HTTP header based tokens that ...
user avatar
  • 3,146
35 votes

How does CSRF correlate with Same Origin Policy

Let us start by defining the term "origin". The origin of a page is decided by three unique factors: hostname, protocol and port number. For example, http://test.com and https://test.com have ...
user avatar
  • 7,275
34 votes
Accepted

Should login and logout action have CSRF protection?

Possibly you should protect against Login CSRF. Without this protection an attacker can effectively reverse a CSRF attack. Rather than the victim being logged in to their own account and the attacker ...
user avatar
34 votes
Accepted

Setting Same-Site cookie attribute to Lax

Is setting Same-Site attribute of a cookie to lax the same as not setting the Same-Site attribute? In Google Chrome < 76 – no. Setting SameSite=lax is safer than omitting the attribute. (But if ...
user avatar
  • 43.6k
27 votes

Is a JWT usable as a CSRF token?

TL;DR A JWT, if used without Cookies, negates the need for a CSRF token - BUT! by storing JWT in session/localStorage, your expose your JWT and user's identity if your site has an XSS vulnerability (...
user avatar
26 votes

Should I use CSRF protection for GET requests?

Ordinarily safe methods do not have to be protected against CSRF because they do not make changes to the application, and even if they're returning sensitive information this will be protected by the ...
user avatar
25 votes
Accepted

How to protect against login CSRF?

With anonymous cookies If you are happy to generate secure tokens which are set as anonymous users' cookies, but not to store them server side then you could simply double submit cookies. e.g. ...
user avatar
25 votes
Accepted

Why is CSRF protection only applicable to web services with browser clients?

It comes down to the fact that CSRF is an attack against browsers, so if your service is exclusively used by non-browsers there's no point in using anti-CSRF defences, which can be expensive so may be ...
user avatar
23 votes
Accepted

Is checking the Referer and Origin headers enough to prevent CSRF, provided that requests with neither are rejected?

Expanding on the answers of @Sjoerd and @lindon. Origin vs Referer vs CSRF token Most likely, the reason OWASP recommends also using a CSRF token, is that at the time when this recommendation was ...
user avatar
23 votes

Why don't browsers block cross-site POSTs by default?

The problem is not the request method: CSRF could also be done with a GET request. The problem is instead that authentication information like (session) cookies or the Authorization header are ...
user avatar
23 votes
Accepted

Is the core idea behind CSRF protection that the hacker doesn't know the token value?

Your understanding is correct. Background The simplest way to think of a CSRF attack is that your browser has two tabs open - Tab A: www.mybank.com and Tab B: www.attacker.com. (As @Alex points ...
user avatar
22 votes
Accepted

Double Submit Cookies vulnerabilities

According to a paper published in Blackhat 2013, it isn't enough for you to implement Double-Submit Cookies in its own sub-domain (e.g. secure.host.com). You really must control all sub-domains: 2.1....
user avatar
  • 2,149
20 votes

Why does an anti-forgery token need so many bits?

Your question makes an assumption that should not be made in the field: wouldn't you be able to detect and lock them out after a few attempts Yes, in a good working environment there should be a ...
user avatar
  • 1,344
20 votes
Accepted

How do I safely host third-party Javascript code in an iframe?

If the content you're embedding will contain untrusted scripts, it must either be loaded in an iframe from an untrusted domain, or be loaded from srcdoc in a sandboxed iframe with the allow-same-...
user avatar
  • 4,567
19 votes
Accepted

how can we find the CSRF vulnerability in a website?

I would probably take the following steps: Identify a URL on your site where a CSRF attack could have a negative effect on your site. For this example lets say a GET request to http://mysite.com/...
user avatar
  • 8,145
18 votes

Do I need CSRF token if I'm using Bearer JWT?

Previous answers are rock solid. I'll jump in here to provide a more context and little caveat. There are lots of ways to using JWT; session management is one of them. Although it presents a few ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible