Hot answers tagged

2

Bit of a rambling question, so bit of a rambling answer also. CSRF can also be defended by including a custom header on XHR requests, and with same site cookies. CORS is not variously defined; it is a W3C standard. What sometimes causes confusion is that CORS is not really a security mechanism. Cross-origin data leaking is an area of active research and ...


1

The only way CSRF prevention with double-submitting can work is by sending the nonce in a cookie. If you send it in the HTTP response body, it can in some cases be parsed out by a script sending a cross-domain request, (if you've allowed CORS for that page) which defeats the whole purpose of protecting against CSRF. The idea is that scripts on domain X can’t ...


Only top voted, non community-wiki answers of a minimum length are eligible