Hot answers tagged

4

The custom HTTP header works as a defense in and of itself. Actually, one rudimentary form of CSRF protection is to simply set a custom header to a constant non secret value and then check for it server side. This protection is sometimes applied unknowingly by simply requireing certain content-type headers. OWASP describes this technique: Adding CSRF ...


2

Bit of a rambling question, so bit of a rambling answer also. CSRF can also be defended by including a custom header on XHR requests, and with same site cookies. CORS is not variously defined; it is a W3C standard. What sometimes causes confusion is that CORS is not really a security mechanism. Cross-origin data leaking is an area of active research and ...


1

The only way CSRF prevention with double-submitting can work is by sending the nonce in a cookie. If you send it in the HTTP response body, it can in some cases be parsed out by a script sending a cross-domain request, (if you've allowed CORS for that page) which defeats the whole purpose of protecting against CSRF. The idea is that scripts on domain X can’t ...


Only top voted, non community-wiki answers of a minimum length are eligible