New answers tagged

3 votes

Is checking the Referer and Origin headers enough to prevent CSRF, provided that requests with neither are rejected?

If you want to rely on the Origin header to prevent XSRF, I suggest deploying the front-end and back-end application on different origins like www.example.com and api.example.com. In this case, the ...
ris's user avatar
  • 31
0 votes
Accepted

javascript app preventing csrf

This anti-CSRF scheme can be vulnerable to CSRF itself, depending on how exactly the hashed token is exchanged between client and server, and how the client includes the token in subsequent requests. ...
Ja1024's user avatar
  • 4,899
1 vote
Accepted

Double Submit Cookie Bypass

There seem to be some confusions with regards to the double-submit pattern and cookies in general. First off, when attacker.com triggers a request to victim.com, the browser may very well include ...
Ja1024's user avatar
  • 4,899
0 votes

How to implement Double Submit Cookie with Encryption or HMAC

Unfortunately, this is the top result on google for HMAC double submit. So I will leave this here. OWASP cheat sheet includes a section on HMAC double submit including some pseudocode. I would suggest ...
Jonathan Laperle's user avatar

Top 50 recent answers are included